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Abstract 


This report describes a requirements specification written in the RSML -e language for the 
mode logic of a Flight Guidance System of a typical regional jet aircraft. This model was created 
as one of the first steps in five-year project sponsored by the NASA Langley Research Center, 
Rockwell Collins Inc., and the Critical Systems Research Group of the University of Minnesota to 
develop new methods and tools to improve the safety of avionics designs. This model will be used 
to demonstrate the application of a variety of methods and techniques, including safety analysis 
of system and subystem requirements, verification of key properties using theorem provers and 
model checkers, identification of potential sources mode confusion in system designs, partitioning 
of applications based on the criticality of system hazards, and autogeneration of avionics quality 
code. While this model is representative of the mode logic of a typical regional jet aircraft, it 
does not describe an actual or planned product. Several aspects of a full Flight Guidance System, 
such as recovery from failed sensors, have been omitted, and no claims are made regarding the 
accuracy or completeness of this specification. 
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Chapter 1 

Introduction 


This report describes a requirements specification written in the RSML _e [8, 6] language for the 
mode logic of a Flight Guidance System of a typical regional jet aircraft. This model was created 
as one of the first steps in a project sponsored by the NASA Langley Research Center. Rockwell 
Collins. Inc., and the Critical Systems Research Group of the University of Minnesota to develop 
new methods and tools to improve the safety of avionics designs. This model will be used to 
demonstrate the application of a variety of methods and techniques, including: 

• Safety analysis of system and subsystem requirements 

• Verification of key properties using theorem provers and model checkers 

• Identification of potential sources mode confusion in system designs 

• Partitioning of applications based on the criticality of system hazards 

• Autogeneration of avionics quality code 

While this model is representative of the mode logic of a typical regional jet aircraft, it does 
not describe an actual or planned product. Several aspects of a full Flight Guidance System, 
such as recovery from failed sensors, have been omitted, and no claims are made regarding the 
accuracy or completeness of this specification. 

The report is organized as follows. In this chapter, Section 1.1 discusses why the modeling 
and analysis of requirements is important to aircraft safety, Section 1 .2 provides an overview of a 
modern Flight Guidance System, and Section 1.3 discusses the the fundamentals of the mode logic 
found in the FGS. Chapter 2 deals with the requirements specification itself. Section 2.1 describes 
how the specification is organized. The remaining sections of Chapter 2 are the specification itself. 

1.1 How Requirements Analysis Relates to Aircraft Safety 

Aircraft safety has improved steadily over the last few decades and much of this improvement 
can be attributed to the introduction of advanced automation in the cockpit. The predicted 
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Accident Category 

Fatalities 

Accidents 

Controlled Flight Into Terrain 

2111 

28 

Loss of Control in Flight 

2011 

29 

In Flight Fire 

600 

3 

Midair Collision 

506 

2 

Fuel Tank Explosion 

238 

2 

Landing 

~200 

14 

Takeoff 

~144 

3 

Ice/Snow 

~60 

3 

Fuel Exhaustion 

~40 

5 

Wind Shear 

~30 

2 

Runway Incursion 

~10 

4 

Misc. Fatality 

~10 

3 

On Ground 

~10 

3 

Refused Takeoff 

~10 

1 

Turbulence 

~10 

3 

Unknown 

482 

7 

Total 

6465 

112 


Table 1.1: Fatal Accidents - Worldwide Commercial Jet Fleet. 1990-1999 - From [14] 


ten-fold increase in air traffic by 2016 will force much greater reliance on automated systems. 
New technologies, such as: Communication. Navigation, and Surveillance for Air Traffic Manage- 
ment (CNS/ATM); Global Air Traffic Management (GATM): Global Positioning System (GPS); 
and fly-by-wire, will be introduced to meet enhanced safety and performance goals. Table 1.1 
classifies the fatal accidents of the worldwide commercial jet fleet for the period of 1990 to 1999. 
Categories in which automated systems can play a role in reducing the accident rate still further 
are emphasized. These account for almost 80 percent of the' accidents and fatalities. 

However, the growing complexity and integration issues associated with these advanced tech- 
nologies also increase the potential for errors that could have a direct impact on safety. As 
systems become more tightly integrated, even the engineers that design them will find it difficult 
to anticipate every possible interaction. Unfortunately, it is precisely these interactions that will 
have the greatest impact on safety: 

Today more accidents result from dangerous design characteristics and interactions 
among components. [10] 

Complex and highly integrated avionics present greater risk for development error. 

With non-traditional human-machine interfaces, there is also the potential for oper- 
ational flight crew errors. Moreover, integration of systems may result in a greater 
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likelihood of undesirable and unintended effects. [2] 

In spite of the increased safety concerns, manufacturers are being asked to design, develop 
and validate the systems of the future under the budgets of the past. It is imperative that new 
methods to improve system safety be developed, and that these methods work in concert with 
the goals of reducing cost and cycle time. 

One of the best ways to improve product quality while reducing costs is to develop a complete, 
consistent, and well organized set of requirement at the start of the product life cycle. As stated 
by Fred Brooks: 

The hardest single part of building a software system . is deciding precisely what to 
build. No other part of the conceptual work is as difficult as establishing the detailed 
technical requirements... No other part of the work so cripples the resulting system if 
done wrong. No other part is as difficult to rectify later. [4] 

The majority of software development errors stem from logic errors made during requirements 
analysis. Most of these errors are not found until the later phases of a project. The amount of 
rework that has to be done to fix a requirements error, and the cost of doing so, grows dramatically 
the later it is detected. [1] In one well-known study, it was found that it costs ten times as much 
to correct a requirements error during unit testing as during requirements analysis. Correcting a 
requirements error after a product had been deployed increased the cost by 100 to 200 times. [3] 
Moreover, requirements errors are often the most serious errors. Investigators focusing on safety- 
critical systems have found that requirements errors are more likely to affect the safety of an 
embedded system than errors introduced during design or implementation. [12] 

One of the most successful approaches to finding requirements errors is to create a precise 
model of the system’s externally visible behavior that can be executed. Several notations have 
been developed over the last few years for creating a model of the system’s functional behavior that 
is both readable and mathematically precise. Among the better known are SCR [7]. RSML [8. 6]. 
SpecTRM [10]. and Statecharts [5]. Creating models based on these notations have been shown to 
find a wealth of errors in textual specifications [6. 13]. Moreover, such models can be connected to 
a mock-up of the user interface and executed with the customer in the same way as a simulation. 
In the best approaches, the underlying notation has been carefully designed to support automated 
analyses. These make possible a variety of consistency and completeness checks that find many 
errors, as well as the ability to check for properties specific to the application being modeled. 
Finally, the requirements model itself becomes a detailed statement of the desired behavior. This 
enhances design and testing, and makes it far more feasible to outsource the software development. 

In short, creation of a precise model of a system’s behavior not only finds errors early in 
the life-cycle when they can be most economically addressed, it enables a variety of downstream 
activities tradionally associated with the quality of the system, including design, coding, and 
verification. Particularly relevant to this report, it lays the foundation for improving system 
safety through analysis: 

Every hazard analysis requires some type of model of the system , which may range from , 
a fuzzy idea in the analyst ’s mind to a complex and carefully specified mathematical 
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model. The model may range from a high-level abstraction to a low-level and detailed 
prototype. Nevertheless, information about, the system must exist in som.e form, and 
that constitutes the system model upon which the analysis is performed. [11] 

The model of a Flight Guidance System described in this report will be used for the demon- 
stration of a wide variety of techniques developed to improve the quality and safety of embedded 
systems, thereby reducing the accident rate shown in Table 1.1. 
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1.2 Overview of a Flight Guidance System 

A Flight Guidance System (FGS) is a component of the overall Flight Control System (FCS). It 
compares the measured state of an aircraft (position, speed, and attitude) to the desired state and 
generates pitch and roll guidance commands to minimize the difference between the measured 
and desired state. A simplified overview of an FCS that emphasizes the role of the FGS is shown 
in Figure 1.1. 



Figure 1.1: Flight Control System Overview 

As shown in Figure 1.1. the FGS subsystem accepts input about the aircraft’s state from the 
Attitude Heading Reference System (AHRS). Air Data System (ADS), Flight Management Sys- 
tem (FMS), and Navigation Radios. Using this information, it computes pitch and roll guidance 
commands that are provided to the Autopilot (AP). When engaged, the Autopilot translates these 
commands into movement of the aircraft’s control surfaces necessary to achieve the commanded 
changes about the lateral and vertical axes. 

The flight crew interacts with the FGS primarily through the Flight Control Panel (FCP), 
shown in more detail in Figure 1.2. The FCP includes switches for turning the Flight Director 
(FD) on and off. switches for selecting the different flight modes such as vertical speed (VS), 
lateral navigation (NAV), heading select (HDG). altitude hold (ALT), and approach (APPR), the 
Vertical Speed/Pitch Wheel, and the autopilot disconnect bar. The FCP also supplies feedback to 
the crew, indicating selected modes by lighting lamps on either side of a selected mode’s button. 
Figure 1.2 depicts a configuration in which Heading Select (HDG) mode is selected. 
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Figure 1.2: Flight Control Panel 


A few key controls, such as the Go Around button and the Autopilot Disengage switch, are 
provided on the control yokes and throttles and routed through the FCP to the FGS. Navigation 
sources are selected through the Display Control Panel (DCP). with the selected navigation source 
routed through the PFD to the FGS. 

The FGS has two physical sides, or channels, one on the left side and one on the right side of 
the aircraft (see Figure 1.1). These provide redundant implementations that communicate with 
each other over a cross-channel bus. Each channel of the FGS can be further broken down into 

the mode logic and the flight control laws. The flight control laws accept information about the 
aircraft’s current and desired state and compute the pitch and roll guidance commands. The 
mode logic determines which lateral and vertical modes of operation are active and armed at any 
given time. These in turn determine which flight control laws are active' and armed. These are 
annunciated, or displayed, on the Primary Flight Displays (PFD) along with a graphical depiction 
of the flight guidance commands generated by the FGS. 

A simplified image of a Primary Flight Display (PFD) is shown in Figure 1.3. The PFDs 
display essential information about the aircraft, such as airspeed, vertical speed, attitude, the 
horizon, and heading. The active lateral and vertical modes are displayed (annunciated) at the 
top of the display. The annunciations in Figure 1.3 indicate that the current active lateral mode 
is Heading Select (HDG), the active vertical mode is Pitch (PTCH). and that Altitude Select 
(ALTS) mode is armed. 

The large sphere in the center of the PFD is the sky/groundball. The horizontal line across 
its middle is the artificial horizon. The current pitch and roll of the aircraft is indicated by a 
white wedge A representing the aircraft in the middle of the sky/ground ball. Figure 1.3 depicts 
an aircraft with zero degrees of roll and pitched up approximately five degrees. 

The graphical presentation of the pitch and roll guidance commands on the PFD are referred 
to as the Flight Director (FD). 1 The pitch and roll guidance commands are shown as a magneta 
wedge A in the sky/ground ball. When the autopilot is not engaged, these are interpreted as 
guidance to the pilot. When the autopilot is engaged, these indicate the direction the aircraft 
is being steered by the autopilot. Figure 1.3 depicts an aircraft in which the autopilot is not 
engaged and the Flight Director is commanding the pilot to pitch up and roll to the right. 


] The term Flight Director is also commonly used to refer to the logic that computes the pitch and roll guidance 
commands. 
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Figure 1.3: Primary Flight Display 
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1.3 Fundamentals of the Mode Logic 


A mode is defined by Leveson as a “mutually exclusive set of system behaviors” [9] . Specifically as 
it relates to an FGS, advisory circular AC/AC.l 25.1329 defines a mode as “a system configuration 
that corresponds to a single (or set of) FGS behavior(s)” [2]. The primary modes of interest in 
an FGS are the lateral and vertical modes. The lateral modes control the behavior of the aircraft 
about the longitudinal, or roll. axis, while the vertical modes control the behavior of the aircraft 
about the vertical, or pitch, axis. In addition, there are a number of auxiliary modes, such as 
half-bank mode, that control other aspects of the aircraft’s behavior. Examples of FGS modes 
include Heading Hold (HDG) which holds the aircraft to a selected heading and Vertical Speed 
(VS) mode which holds the aircraft to selected vertical speed. 

A mode is said to be selected if it has been manually requested by the flight crew or if it has 
been automatically requested by a subsystem such as the FMS. The simplest modes have only 
two states, cleared and selected, as shown in Figure 1.4. Such a mode becomes active immediately 
upon selection with it's associated flight control law providing guidance commands to the flight 
director and. if engaged, the autopilot. When cleared, a mode’s associated flight control law is 
non-operational. i.e.. it does not generate any outputs. 


• — ► 

Cleared 

Selected 


f* - 

| 


Figure 1.4: A Simple Mode 

Some modes can be armed to become active when a criterion is met. such as the acquisition 
of a navigation source or proximity to a target reference such as a desired altitude. Such modes 
have three states as shown in Figure 1.5. The two states armed and active are substates of the 
selected state, i.e.. when the mode is armed or active, it is also said to be selected. While in the 
armed state, the mode's flight control law is not generating guidance commands for the flight 
director or the autopilot, but it may be accepting inputs, accumulating state information, and 
helping to determine if the criterion for becoming active is met. Once the criterion is met. the 
mode transitions to the active state and its flight control law begins generating guidance for the 
flight director and autopilot. Note that the only way to exit the active state is to deselect the 
mode, i.e.. it is not usually possible to revert directly from the active state to the armed state. 



Figure 1.5: A Mode with Armed and Active Substates 
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Some modes also distinguish between capturing and tracking of the target reference or navi- 
gation source. Such a mode is shown in Figure 1.6. Once in the active state, such a mode’s flight 
control law first captures the target by manuvering the aircraft to align it with the navigation 
source or reference. Once correctly aligned, the mode transitions to the tracking state in which it 
holds the aircraft on the target . Both the capture and track states are substates of the active state 
and the mode's flight control law is active in both states, i.e.. generating guidance commands for 
the flight director and autopilot. Note that the only way to exit the active, track, or capture 
states is to deselect the mode. i.e.. it is not possible to revert directly from the track state to the 
capture state or from the active state to the armed state. 



Figure 1.6: A Mode with Capture and Track Substates 

The mode logic consists of all the available modes and the rules for transitioning between 
them. Figure 1.7 provides an overview of the modes described in this specification. Traditionally, 
aircraft modes are associated with a flight control law that determines the guidance provided 
to the flight director or autopilot. For example, in Figure 1.7. there are lateral modes of Roll 
Hold. Heading Hold. Navigation. Lateral Approach, and Lateral Go Around. These control the 
guidance about the longitudinal, or roll. axis. Guidance about the vertical, or pitch, axis is 
controlled by the vertical modes of Pitch. Vertical Speed. Altitude Hold. Altitude Select. Vertical 
Approach, and Vertical Go Around. Each of these are associated with one or more control laws. 

Also shown in Figure 1.7 are several auxiliary modes such as Pilot Flying. Independent Mode. 
FD. and AP. that describe the status of key state variables. While these have an important affect 
upon the behavior of the aircraft, they are not directly associated with specific flight control 
laws, and are not usually viewed as “modes” by system designers in the same wav the lateral and 
vertical modes are. 

In order to provide effective guidance of the aircraft, these modes are tightly synchronized so 
that only a small portion of their total state space is actually reachable. For example, to ensure 
that meaningful guidance is provided to the flight director and autopilot, only one lateral and 
one vertical mode can be active at any time. For the same reason, if the autopilot is engaged or 
the flight director is turned on, at least one lateral and one vertical mode must be active. Other 
constraints enforce sequencing of modes that are dictated by the characteristics of the aircraft and 
the airspace. For example, vertical approach mode is not usually allowed to become active until 
lateral approach mode has become active to ensure that the aircraft is horizontally centered on 
the localizer before tracking the glideslope. These constraints are clearly important to safe flight, 
and can become quite complex. The mode logic is responsible for enforcing all these constraints. 
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Figure 1.7: FGS Mode Logic 
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Chapter 2 


The FGS 


Requirements Specification 


A requirements specification must meet the needs of a diverse set of stakeholders, including but not 
limited to the customer, end users, program management, systems engineers, software engineers, 
hardware engineers, test engineers, and regulatory agencies. It must be clear enough that end 
users can understand it, yet complete and precise enough that the engineers can implement the 
system correctly and develop a comprehensive set of test cases. It must be robust in the face of 
change so that small changes only require small efforts. Ideally, the specification should support 
the development of a family of products, so that it can easily be reused to develop an entire line 
of similar products. 

The FGS requirements specification described in this document is organized to meet these 
goals. Its structure is hierarchial. allowing the reader to start with the entire subsystem, then 
examine individual components in greater detail. To enhance readability, it makes heavy use 
of the tabular formats developed in RSML“ e to make the complex logic of the Traffic Collision 
Avoidance System (TCAS) accessible to pilots, engineers, and regulatory authorities. [6] 

Some of these goals, particularly those related to robustness in the face of change and support 
for product families, are best achieved by organizing the specification into pieces that are logically 
related and likely to change together and by defining interfaces between these components that 
are unlikely to change. The current version of RSML -e does not directly support these notions, 
though extensions are planned for future versions that will. 

However, this specification has been written as though these features were available. Functions 
that are logically related are grouped together into components, with details that are likely to 
change encapsulated within these components. Rather than referring to these directly in the other 
parts of the specification, interfaces (e.g., functions or macros) are defined that should remain 
stable over time for use in the rest of the specification. Many of the architectural decisions 
are based on an extensive commonality analysis of several Flight Guidance Systems to determine 
which features change and which remain stable over a period of time. To facilitate such anticipated 
changes, the architecture implicitly defines a framework in which common patterns and interfaces 
are used across similar components. 


15 



Flight Guidance System 


Air Data 
System 


Independent 

Mode 


Pilot 

Flying 


Auto 

Pilot 


Flight 

Control 

Panel 


Flight Modes 

Lateral Modes 






m 

ROLL 

1 I 

HDG 

I 1 

NAV 

APPR 

GA 

Vertical Modes 





PTCH 

r 

vs 

FLC 

ALT ALT 

SEL 

APPR 

GA 

1 : - - - 7 x 21 


Flight 

Director 


Navigation 

Sources 






Offside 

FGS 

References 

Flight 

Control 

Laws 







Figure 2.1: Flight Guidance Specification Overview 


2.1 Overview of the FGS Specification 

The top level structure of the FGS is shown in Figure 2.1. The enclosing box labeled Flight 
Guidance System represents the full specification. The components located on the edge of the 
Flight Guidance System are boundary components that define the system s view of its interfaces 
with the outside world. These do not define the behavior of the actual external subsystem. 
Rather, they define the behavior of that subsystem that the FGS must be aware of. For example, 
the component labeled Flight Control Panel (FCP) only defines what information is received by 
and sent to the Flight Control Panel and does not define the full behavior of that actual device. 

Each component may define new events or values that are used by other components. For 
example, the FCP mentioned above defines and exports events for each switch that can be pressed 
on the panel. In fact, since several of these events can occur at the same time, the FCP component 
defines a prioritization of these events so that only the highest priority events are seen by the rest 
of the specification (see Section 2.2). 

The heart of the specification is the definition of the mode logic contained in the Modes 
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component. This is further broken down into the Lateral Modes and Vertical Modes, which are 
in turn broken down into individual modes. The lateral and vertical modes all present standard 
interfaces to their parent modules, making it staightforward to add. remove, or substitute modes, 
a common source of variation in a FGS. In addition, many of the modes share a common behavior 
that can be specified once, then tailored to define the behavior of each individual mode. 

The following sections provide an overview of each individual component. Detailed specifica- 
tions of the components can be found in the remainder of this chapter. 

Flight Control Panel (page 103) The Flight Control Panel (FCP) is the primary device with 
which the flight crew interacts with the FGS. This component defines the FGS's view of 
the FCP. This consists of the definition of the monitored variables representing the switches 
and dials of the FCP and the controlled variables representing the lamps displayed on the 
FCP. A few additional inputs, such as the SYNC and AP Disengage switches on the control 
yokes and the GA switches on the throttles, are routed through the FCP aand are defined 
here. This component also defines FCP specific events, such as the pressing of a switch, 
used in the rest of the specification. These events are prioritized so that if multiple events 
occur at the same time, only the most significant events are seen by the other parts of the 
specification. 

Flight Director (page 25) The Flight Director (FD) displays the pitch and roll guidance com- 
mands to the pilot and copilot on the Primary Flight Display. This component defines when 
the Flight Director guidance cues are turned on and off. 

Independent Mode (page 30) Normally, the FGS operates in dependent mode in which the 
pilot flying (PF) side of the FGS provides the mode annunciations and FD guidance com- 
mands to both PFDs. While in dependent mode, the pilot not flying (PNF) side of the FGS 
synchronizes its modes to the pilot flying side. Under final approach conditions and during 
takeoff or go around modes, the FGS operates in independent mode in which each side 
operates independently of the other side and provides mode annunciations and FD guid- 
ance commands to its own PFD. This component defines when the FGS enters independent 
mode. 

Pilot Flying (page 29) The transfer switch on the FCP is used to determine which FGS provides 
mode annunciations and guidance commands to the PFDs while in dependent mode. This 
component defines which side is the Pilot Flying side. It also defines the notion of the 
“active” side of the FGS. A side of the FGS is said to be “active” if it is providing mode 
annunciations and guidance commands to its PFD. 

Flight Control Laws (page 95) The Flight Control Laws generate the pitch and roll guidance 
commands provided to the Flight Director and the Autopilot. Different Flight Control 
Laws are armed or activated based on the current modes of the FGS. They also provide 
inputs to the mode logic that determine when transitions are made from the armed to the 
active state. While the Flight Control Laws are not specified in this model, this component 
defines the interface between them and the mode logic and defines the events provided by 
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the Flight Control Laws that the mode logic depends upon. As with events provided by the 
Flight Control Panel, some of these are prioritized so that if multiple events occur at the 
same time, only the most significant events are seen by the other parts of the specification. 

Navigation Sources (page 127) The FGS receives navigation information from several sources, 
including VHF Omni-Directional Range (VOR) for lateral navigation. Localizer (LOC) 
for precision lateral approach, and Glideslope (GS) for precision vertical approach. This 
component defines the FGS's view of its navigation sources. This includes definition of the 
types of sources available, tin 1 currently selected source, and the information available from 
that source. 

Air Data System (page 128) The Air Data System provides information about the aircraft 
state sensed from the surrounding air mass such as pressure altitude and indicated airspeed. 
This component defines the FGS's view of the Air Data System. 

References (page 120) 

References refer to target values used by several of the modes, such as the Preselected 
Altitude. These may be set by the flight crew through the Flight Control Panel, or set to 
the current aircraft value on entry to a mode or a synchronization request. The references 
may be physically maintained by a variety of systems. This component defines the FGS's 
view of the references. Details of how these values are obtained from other systems are 
encapsulated within this component. 

Autopilot (page 130) The Autopilot (AP) commands the movement the control surfaces based 
on the pitch and roll commands generated by tin' FGS. This component defines the FGS's 
view of the AP. 

Offside FGS (page 133) The FGS has two physical sides, or channels, on the left and right 
sides of the aircraft. These provide redundant implementations that communicate with 
each other over a cross-channel bus. This component defines this side of the FGS’s view of 
the other side. 

Flight Modes (page 32) The flight modes determine which modes of operation of the FGS 
are active and armed at any given moment. These in term determine which flight control 
laws are generating the commands directing the aircraft along the lateral (roll) and vertical 
(pitch) axes. This component encapsulates the definitions of the lateral and vertical modes 
and defines how they are synchronized. 

Lateral Modes (page 35) The lateral modes select the control laws generating commands di- 
recting the aircraft along the lateral, or roll. axis. This component describes the specific 
lateral modes present in this aircraft and defines how they are synchronized. 

Roll Hold (ROLL) Mode (page 37) In Roll Hold mode the FGS generates guidance 
commands to hold the aircraft at a fixed bank angle. Roll Hold mode is the basic 
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lateral mode and is always active when the modes are displayed and no other lateral 
mode is active. 

Heading Select (HDG) Mode (page 40) In Heading Select mode, the FGS provides 
guidance commands to to track the Selected Heading displayed on the PFD. 

Lateral Navigation (NAV) Mode (page 40) In Lateral Navigation mode, the FGS pro- 
vides guidance commands to acquire and track lateral guidance for en route navigation 
and non-precision approaches. Lateral Navigation is an arming mode. i.e.. after being 
selected, it must remained armed for a period of time before it can become active. 

Lateral Approach (LAPPR) Mode (page 50) In Lateral Approach mode, the FGS pro- 
vides guidance commands to acquire and track lateral guidance for precision and non- 
precision approaches. Lateral Approach is an arming mode. i.e.. after being selected, 
it must remained armed for a period of time before it can become active. 

Go Around (GA) Mode) (page 56) In Go Around mode the FGS generates guidance 
commands for the pilot after aborting an approach. The AP is never engaged during Go 
Around mode. Lateral Go Around mode provides guidance to maintain the reference 
heading. 


Vertical Modes (page 60) The vertical modes select the control laws generating commands 

directing the aircraft along the vertical, or pitch, axis. This component describes the specific 

vertical modes present in this aircraft and defines how they are synchronized. 

Pitch Hold (PITCH) Mode (page 62) In Pitch Hold mode the FGS generates guidance 
commands to hold the aircraft at a fixed pitch angle. Pitch Hold mode is the basic 
vertical mode and is always active when the modes are displayed and no other vertical 
mode is active. 

Vertical Speed (VS) Mode (page 65) In Vertical Speed mode, the FGS provides pitch 
guidance commands to to hold the aircraft to the Vertical Speed (VS) reference. 

Flight Level Change (FLC) Mode (page 69) 

In Flight Level Change mode, the FGS provides guidance commands to acquire and 
track an Indicated Airspeed (IAS) or Mach Reference Airspeed, taking into account 
the need to climb or descend to bring the aircraft to the PreSelector Altitude (PSA). 

Altitude Hold (ALT) Mode (page 73) 

In Altitude Hold mode, the FGS provides pitch guidance commands to to acquire and 
track the Altitude reference, which is set to the current altitude when the mode is 
activated or upon a synchronization request by the flight crew. 

Altitude Select (ALTSEL) Mode (page 77) 

In Altitude Select mode, the FGS provides guidance commands to capture and track 
the Preselected Altitude. Altitude Select is an arming mode, i.e., after being selected, it 
must remained armed for a period of time before it can become active. Altitude Select 
mode is normally armed, although it is automically deselected by the activatation of 
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Vertical Approach. Go Around, or Altitude Hold mode. While iu the armed state, the 
FGS monitors the aircraft closure rate towards the target altitude and determines the 
optimum capture point to transition to the capture state. In the capture state, the 
FGS generates vertical guidance commands to perform a smooth capture of the target 
altitude. Once it acquires the target altitude, it enters the track state, during which it 
generates vertical guidance commands to maintain the aircraft at the target altitude. 

Vertical Approach (VAPPR) Mode (page 85) 

In Vertical Approach mode, the FGS provides guidance commands to track vertical 
guidance for ILS precision Glideslope approaches. Vertical Approach is an arming 
mode. i.e.. after being selected, it must remained armed for a period of time before it 
can become active. 

Vertical Go Around (VGA) Mode (page 91) 

In Go Around mode, the FGS provides guidance to the pilot after aborting an ap- 
proach. The AP is never engaged during Go Around mode. Vertical Go Around mode 
provides guidance to maintain a fixed pitch angle. 

2.2 Prioritization of Events 

An issue that frequently arises in the specification of embedded systems is how to handle multiple 
events that occur at the same point in time. Here, we assume that an event corresponds to an 
instantaneous change in some input or state variable. One school argues that since an event 
occurs at a point in time, it is impossible for two events to occur at precisely the same moment, 
and simultaneous events should lx 1 prohibited in the 1 underlying formal model. While theoretically 
appealing, many embedded systems are polling systems that periodically sample their inputs. It 
is difficult to imagine how a polling system could be built that could guarantee that no more 
than one input changes between any two samples. Even interrupt driven systems are ultimately 
implemented as digital systems where interrupts are only handled at well defined boundaries, 
such as the end of an instruction, and multiple interrupts can be observed at these boundaries. 

From a practical standpoint, it seems that the required abstraction is to allow one or more 
events to occur at the same time, and to deal with this within the specification. RSML -e makes 
the one message assumption that at most one message can arrive at any given point in time. 
However, within a message, several fields can change value, allowing more than one input event 
to occur at the same time. Since we did not know how the inputs to the mode logic would be 
implemented in a specific system, we decided to group the inputs into large messages in order to 
make as few assumptions as possible about the disjointness of input events. 

In verifying the behavior of the mode logic, it became clear that the behavior of the system 
when two or more events occurred at the same time would indeed have to be carefully considered 
if the system was to have the correct behavior and satisfy even the most basic of safety properties 
(e.g.. no more than one lateral mode or vertical mode active at the same time). Our approach 
was to define a prioritization of the input events such that only the highest priority event is seen 
by the main body of the specification and the lower priority events are discarded. For example, 


20 



it seems reasonable to respond to the pilot pressing the Go Around switch and ignore the copilot 
pressing the Flight Director switch, rather than the other way around. 

This approach is reasonable for most combinations of events. However, a few events, such as 
the acquisition of a navigation beacon, do not need to be acted upon immediately, but should 
not be simply discarded. These were given the lowest possible priority, and the condition of 
their being true, rather than the event of their becoming true, was used to trigger the associated 
transitions. In this way, processing of the event might be delayed, but would always be completed 
as soon as no higher priority event blocked it. 

Other approaches are of course feasible. For example, one could queue the input events and 
process them in the order received. This introduces considerable complexity into the model, and 
the simpler prioritization described here actually appears to be the more appropriate solution. 
One advantage of this approach is that it makes the solution explicit and easily reviewed. 

We also attempted to localize this logic in the specification by introducing macros (predi- 
cates) of the form When^EvenENameSeen. These macros are true only when the underlying 
event occurs and no higher priority event has occurred at the same time. By using only the 
When-EvenENam.eSeen macros in the body of the specification, it is straightforward to change 
the prioritization of events, or even to implement a more complicated approach such as the 
queueing model discussed earlier. 

As formal verification of the model proceeded, it became clear that it was possible to process 
some combinations of events in parallel. As a result we changed the prioritization from a total to 
a partial order, as shown in Figure 2.2. In this diagram, an event has a higher priority than all 
events that can be reached from it by following a downward chain of arrow and will supersede those 
events. If no path exists between two events, then the two events can be processed concurrently. 
Thus, pressing the SYNC switch supersedes all events except pressing the AP Disconnect or 
AP Engage switch, which can be processed in parallel with it. In like manner, pressing the 
HDG switch will supersede pressing the NAV switch, the Pilot Flying Switch, the Flight Director 
switch, and any of the capture or track conditions. However, a press of the HDG switch can be 
processed in parallel with any of the switches associated only with vertical modes, such as the 
ALT switch. 

It is worth noting that this partial order could only have been verified with confidence through 
the use of formal analysis tools such as model checkers and theorem provers. A full description 
of this verification activity will be provided in a later report. 
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Figure 2.2: The Partial Order of Event Priorities 
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2.3 Basic Definitions 

This section defines types and constants that are used throughout the specification. 
Type 


Side 


Possible Values: LEFT. RIGHT 


Type 


On.Off 


Possible Values: Off. On 


Type 


Base_State 


Possible Values: Cleared. Selected 


Type 


Selected-State 


Possible Values: Armed. Active 


Type 


Active-State 


Possible Values: Capture, Track 
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Constant 


THIS_SIDE 


Units: N/A 
Value: LEFT 

Purpose: This constant defines which side of the FGS (channel) is being specified. The 

specifications of both sides, left and right, are identical except for this constant. 
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2.4 Flight Director (FD) 

The Flight Director (FD) displays the pitch and roll guidance commands to the pilot and copilot 
on the Primary Flight Display. This component defines when the Flight Director guidance cues 
are turned on and off. 


Definitions of Values to be Imported 


Macro | 

When 

Turn_FD_On 


Condition: 


OR 


When_FD _S wit ch_Pressed_Seen m . 103 ( ) 


T 






When(AP v _ 13 2 =Engaged) 



T 





Overspeed_Condition m _i28() 




T 




When_LateraLModeJVIanually_Selected ni -26 ( ) 





T 



When_Vertical_Mode_Manually_Selected m _ 27 () 






T 


When_PilotJFlying_Transfer in _29 ( ) 







T 

Pilot_Flying v _29 =THIS_SIDEleft 







T 

Previous STEP(Mode_Annunciations_On v -33) 







T 


Purpose: This event defines when the onside FD is to be turned on (i.e.. displayed on the 
PFD). 


25 





When_Turn_FD Off 


Condition: 

A 

N 

D 


Purpose: This event defines when the onside FD is to be turned off (i.e.. removed from the 

PFD). 


When_FD_Switch_Pressed_Seen m u 03 () 


T 

Overspeed_Condition m _i28() 


F 


Macro 


When -Lateral -Mode JVIanually_Selected 


Condition: 


OR 


Previous STEP(Mode_Annunciations_On v -33) 


F 

F 

F 

F 





Is_This JS ide _Act i ve v -3o 






T 

T 

T 

T 

When-HDG_Switch_Pressed_Seen m .io 9 () 


T 




T 




Wheii-N AV_Switch_Pressed_Seen m _ 108 () 



T 




T 



When. APPR -Switch _Pressed-Seen ni . n 5 ( ) 




T 




T 


When _G A-S witch-P ressed _Seen m .i i6 ( ) 





T 




T 


Purpose: This event defines when a lateral mode is manually selected. 


26 






Macro 


When_Vertical_Mode_Manually_Selected 


Condition: 


OR 


Previous STEP(Mode_Annunciations_On v _ 33 ) 


F 

F 

F 

F 

F 








Is_This_Side_Active v _3o 







T 

T 

T 

T 

T 

T 

T 

When_VS_Switch_Pressed_Seen m _in() 


T 





T 







When_FLC_Switch-Pressed_Seen m _n 2 () 



T 





T 






When_ALT.Switch_Pressed-Seen m .ii 3 () 




T 





T 





When_APPR-Switch_Pressed_Seen m -ii5() 





T 





T 




When_GA_Switch_Pressed_Seen n> n6() 






T 





T 



When_VS-Pitch_WheeLRotated_Seen m .iio() 












T 


Previous STEP(Is.VS_Active v -6o) 












F 


Previous STEP(Is-VAPPR_Active v _87) 












F 


Previous STEP(Overspeed iv -i28) 












F 


Wheii_ALTSEL_Target_Altitude_Changed_Seen ni _ii 4 () 


' 











T 

Previous STEP(Is_ALTSEL_Active v -8o) 













T 


Purpose: This event defines when a vertical mode is manually selected. 
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Definitions of Values to be Exported 



Onside_FD_On 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 
:= Onside_FD v -28 = 0 n if True 

Purpose: Indicates if the FD Guidance cues should be displayed on the PFD. 



Onside_FD 


Parent: None 

Type: {Off. On} ty _ 2 3 

Initial Value: Off 
Clas sifie d as : State 

Off — ► On if When_Turn_FD_On m _25() 

On] — ♦ [off] if When-Turn_FD_Off m .2c() 

Purpose: This variable maintains the current state of the onside Flight Director. 
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2.5 Pilot Flying (PF) 

The transfer switch on the FCP is used to determine which FGS provides mode annunciations 
and guidance commands to the PFDs while in dependent mode. This component defines which 
side is the Pilot Flying side. It also defines the notion of the “active" side of the FGS. A side of 
the FGS is said to be “active” if it is providing mode annunciations and guidance commands to 
its PFD. 


Definitions of Values to be Exported 


State Variable 


Pilot-Flying 


Parent: None 


Type: {LEFT. RIGHT}, v , 23 
Initial Value: LEFT 
Classified as: State 


LEFT 



RIGHT 






RIGHT | 


LEFT 


When_Transfer_Switch_Pressed_Seen m _ 104 () 
When_Transfer_Switcli_Pressed_Seen m _io4() 


Purpose: This state variable maintains which side this side of the FGS believes is 
the Pilot Flying side. 


Macro 

WhenJPilot_Flying Transfer 

Condition: Changed(Pilot_Flying v _ 29 ) 

Purpose: This event occurs when the pilot flying side changes to the other side. 
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2.6 Independent Mode 

Normally, the FGS operates in dependent mode in which the pilot flying (PF) side of the FGS 
provides the mode annunciations and FD guidance commands to both PFDs. While in 
dependent mode, the pilot not flying (PNF) side of the FGS synchronizes its modes to the pilot 
flying side. Under final approach conditions and during takeoff or go around modes, the FGS 
operates in independent mode in which each side operates independently of the other side and 
provides mode annunciations and FD guidance commands to its own PFD. This component 
defines when the FGS enters independent mode. 


Definitions of Values to be Exported 


State Variable 


Is This_Side_Active 


Parent: None 


Type: Boolean 
Initial Value: TRUE 
Classified as: State 
:= True if 


OR 


A 

N 

D 


Previous STEP(Independent_Mode v _3i) =Off 


F 

T 

T 

Pilot _Flying v _29 =THIS-SIDEleft 



T 

F 

Offside_Modes v _i35 =On 




F 


:= False if 


Previous STEP(IndependentJViode v -3i) =Off 


T 

Pilot _Flying v - 29 =THIS_SIDEleft 


F 

( ) ffside_Modes v _ 135 = O11 


T 


Purpose: A side of the FGS is said to be active if it is the source for guidance to 

the AP its FD. This occurs if the system is in independent mode, if this side of the 
FGS is the pilot flying side, or if the other side of the FGS is the pilot flying side but 
its mode annunciations are not turned on. 
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Definitions of Values to be Encapsulated 


Macro 


Independent_Mode_Condition 


Condition: 


OR 


A 

N 

D 


Is_LAPPR_Active v -52 


T 


Is_VAPPR_Active v _87 


T 


Is_Offside_LAPPR_Active v -i34 


T 


Is_Offside JVAPPR _Act ive v - 134 


T 


Is_VGA_Active v _92 



T 

Is_Offside_VGA_Active v -i35 



T 


Purpose: This condition defines when the system is in independent mode. This occurs when 
lateral and vertical approach modes are active on both sides (channels) or vertical Go Around 
mode is active. 


State Variable 


Independent _Mode 


Parent: None 

Type: {Off, On} ty _ 2 3 

Initial Value: Off 
Classified as: State 

:= On if Independent _Mode_Condition m _3i() 

:= Off if not Independent JVIode_Condition m _3i() 

Purpose: This variable maintains the state of whether this side is in independent 
mode. 

Comment: This variable is introduced to make it easier to access its previous 
value and so that it can be displayed during simulation. 
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2.7 Flight Modes 


The flight modes determine which modes of operation of the FGS are active and armed at any 
given moment. These in term determine which flight control laws are generating the commands 
directing the aircraft along the lateral (roll) and vertical (pitch) axes. This component describes 
the lateral and vertical modes and defines how they are synchronized. 


Definitions of Values to be Imported 


Macro 


When_Turn_Modes_On 


Condition: 


Onside_FD v _28 =On 


T 



Qffside_FD v _i33 =On 



T 


Is_AP_Engaged v _i 3 i 




T 


Purpose: This event defines when the flight modes are to be turned on and displayed on the 
PFD. 


Macro 


When_Turn Modes_Off 


Condition: 


Onside-FD v -2 8 =Off 


T 

Offside JD v _i33 =Off 


T 

APv-i32 = Disengaged 


T 


Purpose: This event defines when the flight modes are to be turned off and removed from the 
PFD. 
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Mode_Annunciations_On 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 

:= Modesv-34 = 0 n if True 

Purpose: Indicates if the inode annunications should be displayed on the PFD. 
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Definitions of Values to be Encapsulated 


State Variable 



Modes 



Parent: None 

Type: {Off, On} ty -23 

Initial Value: Off 
Classified as: State 

: = Offside_Modes v -i35 if not Is_This_Side_Active v -30 


Off 


On 


On 


if 



T 

T 


T 

T 


Purpose: This variable maintains the current state of whether the mode 
annunciations are turned on or off. 
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2.7.1 Lateral Modes 


The lateral inodes select the control laws generating commands directing the aircraft along the 
lateral, or roll, axis. This component describes the specific lateral modes present in this aircraft 
and defines how they are synchronized. 


Definitions of Values to be Encapsulated 


Macho 


When_Nonbasic_Lateral_Mode_Activated 


Condition: 

When_HDG_A.ctivated m . 42 () 
jY When_NAV_Activated m .47() 

D When_LAPPR _Activated m _53 ( ) 
When_LGA_Activated m . 58 () 


OR 


T 





T 





T 





T 


Purpose: This event ocurrs when a new lateral mode other than the basic mode becomes 
active. It is used to deselect active or armed modes. 

Comment: Basic mode is excluded to avoid a cyclic dependency in the definition of this 

macro. 
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Is_No_Nonbasic_Lateral_Mode_Active 


Condition: 



Purpose: This condition indicates if no lateral inode except basic mode is active. It is used to 
trigger the activation of the basic lateral mode. 

Comment: Basic mode is excluded to avoid a cyclic dependency in the definition of this 
macro. 
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2.7.1. 1 Roll Hold (ROLL) Mode 

In Roll Hold mode the FGS generates guidance commands to hold the aircraft at a fixed bank 
angle. Roll Hold mode is the basic lateral mode and is always active when the modes are 
displayed and no other lateral mode is active. 



Select -ROLL 


Condition: 

A 

jy I.s_No_Nonbasic_LateraLMode_Active m -36() 

D Modes v _34 =On 

Purpose: This event defines when Roll Hold mode is to be selected. Roll Hold mode is the 
basic, or default, mode and is selected whenever the mode annunciations are on and no other 
lateral mode is active. 

Comment: To avoid cyclic dependencies, the only way to select Roll Hold mode is to deselect 
the active lateral mode, which will automatically activate Roll Hold. 



Deselect -ROLL 


Condition 

A 

N 

D 

Purpose: The event defines when Roll Hold mode is to be deselected. This occurs when a 
new lateral mode is activated or the modes are turned off. 
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Definitions of Values to be Exported 


State Variable 


Is_ROLL_Selected 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 
:= (ROLLv- 39 =Selected) if True 


Purpose: Indicates if ROLL mode is selected. 


State Variable 


Is_ROLL_Active 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 
:= (ROLLv-39 =Selected) if True 


Purpose: Indicates if ROLL mode is selected. 

Comment: Even though ROLL Selected and ROLL Active are the same value, 

this is defined to provide a common set of controlled variables across all modes. 
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Definitions of Values to be Encapsulated 


State Variable 



ROLL 



Parent: Modes v -34.0n 

Type: {Cleared. Selected} ty -23 

Initial Value: Undefined 
Classified as: State 

:= Offside_ROLL v _i36 if not Is_This_Side_Active v _3o 


Undefined 


Cleared I if 


A 

N 

D 


Select _ROLL m _37 ( ) 


Is_This_Side_Active v . 


30 


Undefined 


Selected if 


Cleared 


Selected 


A 

N 

D 


A 

N 

D 


Select _R OLL ni _37 ( ) 


Is_This_Side_Active 


V-30 


Selected if 


Select _R OLL m _37 ( ) 


Is_This_Side_Active v _; 


30 


Cleared if 


A 

N 

D 


Deselect _ROLL n> 37 ( ) 


Is_This_Side_Active v .; 


v-30 


F 

T 


T 

T 


T 

T 


T 

T 


Purpose: This variable maintains the current base state of Roll Hold mode, i.e., 

whether it is cleared or selected. Note that if this side of the FGS is not active, it 
obtains its value from the off side. The normal transitions occur only when this side 
is active. 
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2. 7.1. 2 Heading Select (HDG) Mode 

In Heading Select mode, the FGS provides guidance commands to to track the Selected Heading 
displayed on the PFD. 


Definitions of Values to be Imported 


Macro 


Select HDG 


Condition: When JHDG_Switch_Pressed-Seen n> i 09 () 

Purpose: This event defines when Heading Select mode is to be selected. 


Macro 


Deselect _HDG 


Condition: 


When JHDG.S witch-Pressed _Seen m _io()() 

A — 

jY When_Nonbasic_LateraLMode_Activated m _35() 
D When_Pilot_Flying_Transfer ni _29() 
When(Modes v .34 =Off) 


OR 


T 





T 





T 





T 


Purpose: This event defines when Heading Select mode is to be deselected. 
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Definitions of Values to be Exported 


State Variable 


Is_HDG_Selected 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 

:= (HDGv-43 = Selected) if True 


Purpose: Indicates if HDG mode is selected. 


State Variable 


IsJHDG_Active 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 
:= (HDGv-43 = Selected) if True 


Purpose: Indicates if HDG mode is active. 

Comment: Even though HDG Selected and HDG Active are the same value, this 
is defined to provide a common set of controlled variables across all modes. 
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When_HDG_Activated 


Condition: 

A Select -HDG m _ 4 o() 

^ Previous Step(HDG v -43) =SeIected 

Is_This_Side_Active v -3o 

Purpose: This signal occurs when Heading Select mode is activated. 

Comment: This event is defined this way to avoid circular dependencies. It would be 
preferable to define it as When(HDG = Selected). 
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Definitions of Values to be Encapsulated 


State Variable 



HDG 



Parent: Modes v .34.0n 

Type: {Cleared, Selected }t , v -23 

Initial Value: UNDEFINED 
Classified as: State 

Purpose: This variable maintains the current base state of Heading Select mode. i.e.. whether 
it is cleared or selected. Note that if this side of the FGS is not active, it obtains its value from 
the off side. The normal transitions occur only when this side is active. 

: =; Offside_HDG v -i36 if not Is_This_Side.Active v -3o 


Undefined 


Cleared if 


A 

N 

D 


Select _HDG 


m-40 


0 


Is. This.Side. Active 


V-30 


Undefined 


Selected if 


A 

N 

D 


Select_HDG m _4o() 


Is_This-Side_Active v _; 


V-30 


.F 

T 


T 

T 


Cleared 


Selected if 


A 

N 

D 


Select _HDG m . 40 () 


Is.This_Side_Active v . : 


V-30 


T 

T 


Selected 


Cleared 


if 


A 

N 

D 


Deselect _HDG m _4o ( ) 


T 

Is_This_Side_Active v -3o 
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2. 7. 1.3 Navigation (NAV) Mode 

In Lateral Navigation mode, the FGS provides guidance commands to acquire and track lateral 
guidance for en route navigation and non-precision approaches. Lateral Navigation is an arming 
mode, i.e., after being selected, it must remained armed for a period of time before it can 
become active. 


Definitions of Values to be Imported 


Macro 


Select _NAV 


Condition: When_NAV_Switch_Pressed-Seen m _i08() 

Purpose: This event defines when Lateral Navigation mode is to be selected, i.e.. to become 

armed. 


Macro 

Act,ivate_NAV 

Condition: Wheii_NAV-Track_Cond_Met_Seen m _95() 

Purpose: This event defines when Lateral Navigation mode is to transition from the armed to 
the active state. 
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Macro 


Deselect_NAV 


Condition: 


A 

N 

D 


OR 


WheiiJ^AV-Switcli_PressedJ 3 een m -io 8 () 


When-Selected JMav-Source_Changed v .i27 


When-Selected _Nav -Frequency .Changed 


v-127 


When -P ilot _F 1 y ing _Tr ansfer 2 9 ( ) 


When ( Modes v -34 =Off) 


T 





T 





T 


A 

_ 



T 






T 


Purpose: This event dehnes when Lateral Navigation mode is to be deselected, i.e.. to be 
cleared regardless of whether it is armed or active. 


Macro 


Dearm_NAV 


Condition: When_L APPR _Armed m _53 () 

Purpose: This event defines when Lateral Navigation mode is to be cleared if it is armed, but 
to remain active if it is active. 


Macro 


Deactivate _N AY 


Condition: When-Nonbasic_Lateral_Mode_Activated m _35 0 

Purpose: This event defines when Lateral Navigation mode is to be cleared if it is active, but 
to remain armed if it is armed. 
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Definitions of Values to be Exported 


State Variable 


Is_NAV_Selected 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 

:= ( N AV v-48 ^Selected) if True 


Purpose: Indicates if NAY mode is selected. 


State Variable 


IsJNAV_Active 


Parent: None 

Type: Boolean 

Initial Value: False 

Classified as: CONTROLLED 

:= (NAV_Selected v -49 =Active) if True 


Purpose: Indicates if NAV mode is active. 
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Macro 


When.NAV .Armed 


Condition: 


Select _N AV m . 44 ( ) 


T 

Previous Step(NAV v _ 48 ) =Cleared 


T 

Is-This.Side_Active v _3o 


T 


Purpose: This signal occurs when Lateral NAV mode is armed. 


Comment: This event is defined this way to avoid circular dependencies. It would be 
preferable to define it as When (NAV .Selected = Armed). 


Macro 


When_NAV_Activated 


Condition: 


Act i vate AV m .44 ( ) 


T 

Previous STEP(NAV.Selected v _4 9 ) =Armed 


T 

Is_This_Side_Active v - 3 o 


T 


Purpose: This signal occurs when Lateral Navigation mode is activated. 


Comment: This event is defined this way to avoid circular dependencies. It would be 

preferable to define it as When ( N AV .Selected - Active). 
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Definitions of Values to be Encapsulated 


State Variable 



NAY 



Parent : Modes v _34 . On 

Type: {Cleared. Selected ) ty -23 

Initial Value: Undefined 
Classified as: State 

:= Offside_NAV v -i37 if not Is-This_Side-Active v -3o 


Undefined 


Cleared 


if 


A 

N 

D 


Select _NAV m .44() 


Is_This_Side_Active 


'v-:w 


Undefined 


Selected if 


A 

N 

D 


Select _N AV ni .4 4 ( ) 


Is_This_Side_Active v .; 


V-30 


Cleared 


A 

N 

D 


Selected [ if 


Select _N AV in _44 () 


Is_This_Side_Active v _ : 


v-30 


Selected 


Cleared if 



T 

T 


T 

T 


OB 


Deselect JSf AV m -4 5 ( ) 


T 



Dearn 1 _N AV n ,_4 5 ( ) 



T 


Previous STEP(NAV_Selected v _4g) =Armed 



T 


D(>act i vate_N AV m _45 ( ) 




T 

Previous S t e p ( N AV _Selec t ed v .4 9 ) ^Active 




T 

Is_This_Side_Active v -3o 


T 

T 

T 


Purpose: This variable maintains the current base state of Lateral Navigation 
mode, i.e., whether it is cleared or selected. Note that if this side of the FGS is not 
active, it obtains its value from the oft side. The normal transitions occur only when 
this side is active. 
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State Variable 


NAY .Selected 


Parent: Modes v -34.0n t> NAV v -48- Selected 

Type: {Armed. Active} ty -23 

Initial Value: UNDEFINED 
Classified as: State 

:= Offside_NAV_Selected v _i37 if not Is_This_Side_Active v _3o 


Undefined 


Armed if True 


Armed 


A 

N 

D 


Active if 


Activate_NAV m _ 44 () 


Is_This_Side_Active 


v-30 


T 

T 


Purpose: Tliis variable maintains the current state of Lateral Navigation mode 
when it is selected, i.e., whether it is armed or active. Note that if this side of the 
FGS is not active, it obtains its value from the off side. The normal transitions 
occur only when this side is active. 


49 








2. 7. 1.4 Lateral Approach (LAPPR) Mode 

In Lateral Approach mode, the FGS provides guidance commands to acquire and track lateral 
guidance for precision and non-precision approaches. Lateral Approach is an arming mode, i.e. 
after being selected, it must remained armed for a period of time before it can become active. 


Definitions of Values to be Imported 


Macro 


Select _LAPPR 


Condition: WhemAPPR _S witch _Pressed_Seen, n _i 15() 

Purpose: This event defines when Lateral Approach mode is to be selected, i.e.. to become 

armed. 


Macro 

Activate JL APPR 

Condition: When_LAPPR_Track_Cond-Met_Seen m _ 98 () 

Purpose: This event defines when Lateral Approach mode is to transition from the armed to 
the active state. 
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Macro 


Deselect _LAPPR 


Condition: 


OR 


When_APPR_Switch_Pressed_Seen m _ii 5 () 


T 





When_SelectedJMavJ3ource_Changed v _i27 



T 




When_Selected_N av -Frequency _Changed v . 127 




T 



When_Pilot_Flying_Transfer m _ 2 g() 





T 


When(Modes v -34 =Off) 






T 


Purpose: This event defines when Lateral Approach mode is to be deselected, i.e., to ire 
cleared regardless of whether it is armed or active. 


Macro 


Dearm JLAPPR 


Condition: When_NAV_Armed m _47 0 

Purpose: This event defines when Lateral Approach mode is to be cleared if it is armed, but 
to remain active if it is active. 


Macro 


Deactivated APPR 


Condition: When_Nonbasic_LateraLMode_Activated m . 35 () 

Purpose: This event defines when Lateral Approach mode is to be cleared if it is active, but 
to remain armed if it is armed. 
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Definitions of Values to be Exported 


State Variable 


Is_LAPPR_Selected 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 
:= (LAPPRv-54 ^Selected) if True 


Purpose: Indicates if LAPPR mode is selected. 


State Variable 


Is _L APPR_Active 


Parent: None 

Type: Boolean 

Initial Value: False 

Classified as: CONTROLLED 

:= (LAPPR_Select-ed v _55 ^Active) if True 


Purpose: Indicates if LAPPR mode is active. 
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Macro 


When_LAPPFCArmed 


Condition: 


Select _L APPR m _5o ( ) 


T 

Previous Step(LAPPR v _ 54 ) ^Cleared 


T 

Is_This_Side_Active v _3o 


T 


Purpose: This signal occurs when Lateral Approach mode is armed. 


Comment: This event is defined this way to avoid circular dependencies. It would be 
preferable to define it as When(LAPPR_Selected = Armed). 


Macro 


When_LAPPR_Activated 


Condition: 


Activate_LAPPR m _ 5 o() 


T 

Previous STEP(LAPPR_Selected v -55) =Armed 


T 

Is_This_Side_Active v - 3 o 


T 


Purpose: This signal occurs when Lateral Approach mode is activated. 

Comment: This event is defined this way to avoid circular dependencies. It would be 

preferable to define it as When(LAPPR_Selected = Active). 


53 





LAPPR 


Parent: Modes v - 34 -On 

Type: {Cleared. Selected } ty -23 
Initial Value: Undefined 
Classified as: State 

:= Offside _LAPPR V - 138 if not Is_This_Side_Active v _3o 



A 

N 

D 


Purpose: This variable maintains the current base state of Lateral Approach 
mode, i.e. , whether it is cleared or selected. Note that if this side of the FGS is not 
active, it obtains its value from the off side. The normal transitions occur only when 
this side is active. 


Deselect -LAPPR m _-, i ( ) 

Dearm_LAPPR m _5i () 

Previous STEP(LAPPR_Selected v _ 5 5) =Armed 
Deactivate_LAPPR m - 5 i () 

Previous STEP(LAPPR_Selected v _5 5 ) =Active 
Is_This_Side_Active v _ 3 o 
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State Variable 


LAPPR_Selected 


Parent: Modes v .34.0n t> LAPPR V _54. Selected 

Type: {Armed. Active} t y -23 

Initial Value: Undefined 
Classified as: State 

:= OffsideXAPPR_Selectedv-i38 if not Is_This_Side.Active v .3o 


Undefined 


Armed 


if 


True 


Armed 


Active 


if 


jy Activate_LAPPR m .5o() 
D Is.This_Side_Active v -3o 


T 

T 


Purpose: This variable maintains the current state of Lateral Approach mode 
when it is selected, i.e., whether it is armed or active. Note that if this side of the 
FGS is not active, it obtains its value from the off side. The normal transitions 
occur only when this side is active. 
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2. 7.1. 5 Lateral Go Around (LGA) Mode 

In Go Around mode the FGS generates guidance commands for the pilot after aborting an 
approach. The AP is never engaged during Go Around mode. Lateral Go Around mode 
provides guidance to maintain the reference heading. 


Definitions of Values to be Imported 


Macro 


Select Jl/GA 


Condition: 

A 

N 

D 


Purpose: This event defines when Lateral Go Around mode is to be selected. 


When_G A -Switch -Pressed _Seen m _i i<-;() 


T 

Overspeed_Condition m -i 28 () 


F 


Macro 


Deselect_LGA 


Condition: 


OR 


A 

N 

D 


When(AP v _i 32 = Engaged) 


T 






When_Nonbasic_LateraLMode_Activated m _35() 



T 





When_Nonbasic_VerticaLMode_Activated m _6o() 




T 




\Vhen_S YNC _S witch-Pressed_Seen m . 1 1 7 ( ) 





T 



Wlien_Pilot_Flying_Transfer m _ 29 () 






T 


When(Modes v _34 =Off) 







T 


Purpose: This event defines when Lateral Go Around mode is to be deselected. 
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Definitions of Values to be Exported 


State Variable 


IsJLGAJSelected 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 
:= (LGA v _59 =Selected) if True 


Purpose: Indicates if LGA mode is selected. 


State Variable 


Is_LGA_Active 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 
:= (LGA v .59 =Selected) if True 


Purpose: Indicates if LGA mode is active. 

Comment: Even though LGA Selected and LGA Active are the same value, this 
is defined to provide a common set of controlled variables across all modes. 
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Macro 


When_LGA_Activated 


Condition: 


A 

N 

D 


Purpose: This signal occurs when Lateral Go Around mode is activated. 

Comment: This event is defined this way to avoid circular dependencies. It would be 
preferable to define it as When(LGA = Selected). 


Select _LGA m _560 


T 

Previous Step(LGA v _ 5 9 ) =Selected 


F 

Is_This_Side_Active v _3o 


T 
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Definitions of Values to be Encapsulated 


State Variable 



LGA 



Parent: Modes v -34.0n 

Type: {Cleared, Selected } ty -23 

Initial Value: Undefined 
Classified as: State 

:= Offside_LGA v _]3<) if not Is_This_Side_Active v _3o 


Undefined 


Cleared if 


A 

N 

D 


Select _LGA 


m-56 


0 


Is-Tliis_Side -Active 


v-30 


Undefined 


Selected if 


A 

N 

D 


Select _LG A m _56 ( ) 


I.s_This_Side_Active 


V-30 


Cleared 


A 

N 

D 


Selected if 


Select _LGA m _56 () 


Is_This-Side_Active v .; 


30 


Selected 


Cleared if 


A 

N 

D 


Dc'sek'ct _LG A m _56 ( ) 


Is_This_Side_Active 


V-30 


F 

T 


T 

T 


T 

T 


T 

T 


Purpose: This variable maintains the current state of Lateral Go Around mode. 
Note that if this side is not active, it obtains its value from the off side. The normal 
transitions for Lateral Go Around mode occur only when this side is active. 
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2.7.2 Vertical Modes 


The vertical modes select the control laws generating commands directing the aircraft along the 
vertical, or pitch, axis. This component describes the specific vertical modes present in this 
aircraft and defines how they are synchronized. 


Definitions of Values to be Encapsulated 


Macro 


When_Nonbasic_Vertical_Mode_Activated 


Condition: 


OR 


A 

N 

D 


When_VS-Activated m .67() 


T 






When_FLC_Activated m _ 7 i () 



T 





\Vhen_ALT_Activated m _75() 




T 




When_ALTSEL_Activated in _8i() 





T 



Wlieii-VAPPR _Activated m .88() 






T 


When_VGA_Activated m . 93 () 







T 


Purpose: This event indicates when a new vertical mode other than the basic mode becomes 
active. It is used to deselect active or armed modes. 


Comment: Basic mode is excluded to avoid a cyclic dependency in the definition of this 
macro. 
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Macro 


IsJNo_Nonbasic_Vertical_Mode_Active 


Condition: 


Is_VS_Active v -6G 


F 

Is_FL C -Act i ve v _7 1 


F 

Is_ALT_Active v _74 


F 

Is_ALTSEL_Active v _8o 


F 

Is_VAPPR_Active v -87 


F 

Is_VGA_Active v _92 


F 


Purpose: This condition indicates if no vertical mode except basic mode is active. It is used 
to trigger the activation of the basic lateral mode. 


Comment: Basic mode is excluded to avoid a cyclic dependency in the definition of this 
macro. 
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2. 7.2.1 Pitch Hold (PITCH) Mode 

In Pitch Hold mode the FGS generates guidance commands to hold the aircraft at a fixed pitch 
angle. Pitch Hold mode is the basic vertical mode and is always active when the modes are 
displayed and no other vertical mode is active. 


Definitions of Values to be Imported 


j Macro 


Select -PITCH 


Condition: 

A 
N 
D 

Purpose: Pitch Hold mode is the basic, or default, mode and is selected whenever the mode 

annunciations are on and no other vertical mode is active. 

Comment: To avoid cyclic dependencies, the only way to select Pitch Hold mode is to 
deselect the active vertical mode, which will automatically activate Pitch Hold mode. 


Is_No_Nonbasic_VerticaLMode_Active m _ 6 i () 


T 

Modes v .34 =On 


T 


Macro 


Deselect .PITCH 


Condition: 


A 

N 

D 


When_Nonbasic_VertioaLMode_Aetivated in _ oo () 
When(Modes v _34 —Off) 



Purpose: Pitch Hold mode is deselected when: a new vertical mode is activated or the modes 
are turned off. 
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Definitions of Values to be Exported 


State Variable 


IsJPITCFLSelected 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 

:= (PITCH v _ 64 =Selected) if True 


Purpose: Indicates if PITCH mode is selected. 


State Variable 


Is_PITCH_Active 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 

:= (PITCH v . 64 = Selected) if True 


Purpose: Indicates if PITCH mode is active. 

Comment: Even though PITCH Selected and PITCH Active are the same value, 
this is defined to provide a common set of controlled variables across all modes. 
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PITCH 


Parent: Modes v -34.0n 

Type: {Cleared, Selected}t y -23 

Initial Value: Undefined 
Classified as: State 

:= Offside_PITCH v -i39 if not Is-This_Side_Active y _3o 



Purpose: This variable maintains the current base state of Pitch Hold mode, i.e., 
whether it is cleared or selected. Note that if this side of the FGS is not active, it 
obtains its value from the off side. The normal transitions occur only when this side 
is active. 
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2. 7.2. 2 Vertical Speed (VS) Mode 

In Vertical Speed mode, the FGS provides pitch guidance commands to to hold the aircraft to 
the Vertical Speed (VS) reference. 


Definitions of Values to be Imported 


Macro 


Select. VS 


Condition: 


A 

N 

D 


Purpose: This event defines when Vertical Speed mode is to he selected. 


When_VS-Switch_Pressed_Seen m _ni() 


T 

Overspeed_Condition m _i28() 


F 

Previous STEP(Is_VAPPR_Active v - 87 ) 


F 


Macro 


Deselect .VS 


Condition: 


A 

N 

D 


\Vlieii_VS_Switch_Pressed_Seen m _ niO 
When_Nonbasie_Vertical_Mode_Activated m . 60 () 
When-Pilot _Flying_Transfer m .29 ( ) 
When(Modes v -34 =Off) 


OR 


T 





T 





T 





T 


Purpose: This event defines when Vertical Speed mode is to be deselected. 
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Definitions of Values to be Exported 


State Variable 


Is_VS_Selected 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 
:= (VSy-68 =Selected) if TRUE 


Purpose: Indicates if VS mode is selected. 


State Variable 


Is_VS_Active 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 
:= (VSy-68 ^Selected) if True 


Purpose: Indicates if VS mode is active. 

Comment: Even though VS Selected and VS Active are the same value, this is 
defined to provide a common set of controlled variables across all modes. 
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Macro 


WhenJVS.Activated 


Condition: 


A 

N 

D 


Purpose: This signal occurs when Vertical Speed mode is activated. 

Comment: This event is defined this way to avoid circular dependencies. It would be 
preferable to define it as When(VS — Selected). 


Select -VS m -65() 


T 

Previous Step(VS v - 68) =Selected 


F 

Is_This_Side_Active v -3o 


T 
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vs 


Parent: Modes v - 34 -On 

Type: {Cleared. Selected } ty -23 

Initial Value: Undefined 
Classified as: State 

:= Offside.VS v .i4o if not Is_This_Side_Active v -30 



Purpose: This variable maintains the current base state of Vertical Speed mode, 
i.e.. whether it is cleared or selected. Note that if this side of the FGS is not active, 
it obtains its value from the off side. The normal transitions occur only when this 
side is active. 
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2. 7.2.3 Flight Level Change (FLC) Mode 

In Flight Level Change mode, the FGS provides guidance commands to acquire and track an 
Indicated Airspeed (IAS) or Mach Reference Airspeed, taking into account the need to climb or 
descend to bring the aircraft to the PreSelector Altitude (PSA). 


Definitions of Values to be Imported 


Macro 


Select _FLC 


Condition: 


When_FLC_Switdi_Pressed_Seen n ,_n 2 () 
Previous STEP(Is_VAPPR_Active v .87) 
A Overspeed_Condition m .i 28 () 

N Previous Step(Is_ALT -A ctive^) 
When_ALT_Activated m _ 75 () 

Previous STEP(Is_ALTSEL^.ctive v _8o) 
When_ALTSEL_Activated m -8i() 


OR 


T 


F 



T 


F 


F 


Y 


F 


Purpose: 


This event defines when Flight Level Change mode is to be selected. 
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Is_FLC_Selected 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 

:= (FLCv-72 = Selected) if True 


Purpose: Indicates if FLC mode is selected. 
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State Variable 


Is_FLC_Active 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 
:= (FLC v _72 =Selected) if True 


Purpose: Indicates if FLC mode is active. 

Comment: Even though FLC Selected and FLC Active are the same value, this is 
defined to provide a common set of controlled variables across all modes. 


Macro 


When_FLC_Activated 


Condition: 


Select_FLC m - 69 () 


T 

Previous Step(FLC v - 72) =Selected 


F 

Is_This_Side_Active v -3o 


T 


Purpose: This signal occurs when Flight Level Change mode is activated. 


Comment: This event is defined this way to avoid circular dependencies. It would be 
preferable to define it as When(FLC = Selected). 
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FLC 


Parent: Modes v - 34 -On 

Type: {Cleared, Selected } ty-23 

Initial Value: Undefined 
Classified as: State 

:— Offside_FLC v _i4o if not Is_This_Side_Active v -3o 



Purpose: This variable maintains the current state of Flight Level Change mode. 
Note that if this side is not active, it obtains its value from the off side. The normal 
transitions for Heading Select mode occur only when this side is active. 
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2. 7.2.4 Altitude Hold (ALT) Mode 

In Altitude Hold mode, the FGS provides pitch guidance commands to to acquire and track the 
Altitude reference, which is set to the current altitude when the mode is activated or upon a 
synchronization request by the flight crew. 


Definitions of Values to be Imported 


Macro 


Select _ALT 


Condition: 


When_ALT_Switch_Pressed^Seen m _ 1 13 ( ) 

A 

jy Previous STEP(Is-VAPPR_Active v -87) 

D WhemALTSEL .Target. Alt itude_Changed_Seen m _i 14 () 

Previous S t e p ( Is A LT SEL_Tr ack v _ 80 ) 


OR 


T 


F 

F 


T 


T 


Purpose: This event defines when Altitude Hold mode is to be selected. 


Macro 


Deselect _ALT 


Condition: 


OR 


A 

N 

D 


When_ALT_Switch_Pressed_Seen m _ii 30 


T 




When_VS_Pitch_Wheel_Rotated_Seen n> no() 



T 



When_Nonbasic_VerticaLMode_Activated m _ 6 o() 




T 


When_Pilot_Flying_Transfer m .29() 





T 

When(Modes v -34 =Off) 







T 


Purpose: This event defines when Altitude Hold mode is to be deselected. 
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Definitions of Values to be Exported 


State Variable 


Is_ALT .Selected 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 

:= (ALT v _7g ^Selected) if True 


Purpose: Indicates if ALT mode is selected. 


State Variable 


Is _ALT .Active 


Parent: None 

Type: BOOLEAN 

Initial Value: False 
Classified as: CONTROLLED 

:= (ALT v _7g = Selected) if True 


Purpose: Indicates if ALT mode is active. 

Comment: Even though ALT Selected and ALI Active are the same value, this is 
defined to provide a common set of controlled variables across all modes. 
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When_ALT -Activated 


Condition: 

A Select _ALT m - 73 Q 

N Previous Step(ALT v . 76 ) ^Selected 
Is_This-Side_Active v .3o 

Purpose: This signal occurs when Altitude Hold mode is activated. 

Comment: This event is defined this way to avoid circular dependencies. It would be 
preferable to define it as When(ALT = Selected). 
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ALT 


Parent: Modes v -34.0n 

Type: {Cleared, Selected }t y -23 

Initial Value: UNDEFINED 
Classified as: State 

:= Offside_ALT v .i4i if not Is_This_Side_Active v -3o 



Purpose: This variable maintains the current base state of Altitude Hold mode, 

i.e., whether it is cleared or selected. Note that if this side of the FGS is not active 
it obtains its value from the off side. The normal transitions occur only when this 
side is active. 
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2. 7.2. 5 Altitude Select (ALTSEL) Mode 

In Altitude Select mode, the FGS provides guidance commands to capture and track the 
Preselected Altitude. Altitude Select is an arming mode, i.e.. after being selected, it must 
remained armed for a period of time before it can become active. Altitude Select mode is 
normally armed, although it is automically deselected by the activatation of Vertical Approach. 
Go Around, or Altitude Hold mode. While in the armed state, the FGS monitors the aircraft 
closure rate towards the target altitude and determines the optimum capture point to transition 
to the capture state. In the capture state, the FGS generates vertical guidance commands to 
perform a smooth capture of the target altitude. Once it acquires the target altitude, it enters 
the track state, during which it generates vertical guidance commands to maintain the aircraft 
at the target altitude. 


Definitions of Values to be Imported 


Macro 


Select_ALTSEL 


Condition: 


A 

N 

D 


Purpose: This event defines when Altitude Select mode is to be selected, i.e.. to become 

armed. Altitude Select mode is armed or active except when Vertical Approach. Go Around, or 
Altitude Hold are active. 


Is.VAPPR_Active v -87 


F 

Is_VGA _ Act i ve v -92 


F 

Is_ALT_Active v -74 


F 

ModeSv-34 =On 


T 
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Macro 

Capture.ALTSEL 

Condition: When_ALTSEL_Capture_Cond_Met_Seen m _970 

Purpose: This event defines when Altitude Select mode is to transition from the armed to the 
capture state. 


j Macro 

Track_ALTSEL 

Condition: When_ALTSEL_Track_Cond J\let_Seen m -96() 

Purpose: This event defines when Altitude Select mode is to transition from the capture to 
the track state. 


Macro 


Deselect _ALTSEL 


Condition: 


OR 


Is_VAPPR_Active v _N 7 


T 




Is.VGA_Active v -92 



T 



Is_ALT_Active v _74 




T 


When(Modes v _34 =Gff) 





T 


Purpose: This event defines when Altitude Select mode is to be deselected, i.e., to be cleared 
regardless of whether it is armed or active. Altitude Select mode is armed or active except when 
Vertical Approach. Go Around, or Altitude Hold are active. 
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Macro 


Deactivate_ALTSEL 


Condition: 


A 

N 

When_ALTSEL_Target_Altitude_Changed_Seen m _i 14 () 


T 




When_VS_Pitch_Wheel-Rotated_Seen m _no() 



T 



D 

When .Pilot _Flying_Transfer m _29 ( ) 




T 



When_.Nonbasic-VerticaLMode_Activated ni _6o() 





T 


Purpose: This event defines when Altitude Select mode is to be cleared if it is active, but to 
remain armed if it is armed. 


Definitions of Values to be Exported 


State Variable 


Is_ALTSEL_Selected 


Parent: None 

Type: Boolean 
I nitial Value: False 
Classified as: CONTROLLED 
:= (ALTSEL v _82 = Selected) if True 


Purpose: Indicates if ALTSEL mode is selected. 
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State Variable 


Is_ALTSEL_Active 


Parent: None 

Type: BOOLEAN 

Initial Value: False 

Classified as: CONTROLLED 

:= (ALTSEL_Selected v -83 =Active) if True 


Purpose: Indicates if ALTSEL mode is active. 


State Variable 


Is_ALTSEL_Track 


Parent: None 

Type: Boolean 

Initial Value: False 

Classified as: CONTROLLED 

:= (ALTSEL Active v _84 = Track) if True 


Purpose: Indicates if ALTSEL mode is tracking. 
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Macro 


When_ALTSEL_Activated 


Condition: 


A 

N 

D 


Purpose: This signal occurs when Altitude Select mode is activated, i.e., it enters the capture 

state. 

Comment: This event is defined this way to avoid circular dependencies. It would he 
preferable to define it as When(ALTSEL_Selected = Active). 


Capture_ALTSEL m _78 0 


T 

Previous STEP(ALTSEL_Selected v . 83 ) =Armed 


T 

Is_This_Side_Active v _3o 


T 
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Definitions of Values to be Encapsulated 


State Variable 



ALTSEL 



Parent: Modes v -34.0n 

Type: {Cleared. Selected }t y -23 
Initial Value: UNDEFINED 
Classified as: State 

:= Offside_ALTSEL v _i4i if not Is_This_Side_Active v -30 


Undefined 


Cleared if 


A 

N 

D 


Select _ALTSEL m . 77 ( ) 


Is_Tliis_Side_Active v -30 


Undefined 


Selected if 


Cleared 


A 

N 

D 


A 

N 

D 


Select -ALTSEL,, 


r() 


Is_This_Side_Active v .; 


30 


Selected if 


Select _ALTSEL ni - 77 () 


Is_This_Side_Active v -; 


30 


Selected 


Cleared I if 


A 

N 

D 


Deselect _ALTSEL m . 78 0 


Is_Tliis_Side_Active v . 


30 


F 

T 


T 

T 


T 

T 


T 

T 


Purpose: This variable maintains the current base state of Altitude Select mode, 
i.e., whether it is cleared or selected. Note that if this side of the FGS is not active, 
it obtains its value from the off side. The normal transitions occur only when this 
side is active. 
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State Variable 


ALTSEL_Selected 


Parent: Modes v .34.0n > ALTSEL v _g2 .Selected 


Type: {Armed. Active} ty -23 
Initial Value: Undefined 
Classified as: State 

:= OffsideA.LTSEL_Selected v .i42 if not Is_This_Side_Active v _ 3 o 


Undefined 


Armed 


if 


True 


Armed 


Active if 


Active 


A 

N 

D 


A 

N 

D 


Capture_ALTSEL m -78() 


Is_This_Side_Active v .; 


v-30 


Armed if 


Deactivate_ALTSEL 


rn-79 


0 


Is.'I'his. Side.. Act ive v ..-. 


30 


T 

T 


T 

T 


Purpose: This variable maintains the current state of Altitude Select mode when 

it is selected, i.e.. whether it is armed or active. Note that if this side of the FGS is 
not active, it obtains its value from the off side. The normal transitions occur only 
when this side is active. 
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State Variable 


ALTSEL_ Active 


Parent: Modes v - 34 -On > ALTSEL V _ 82 -Selected i> ALTSEL_Selec.ted v -83 -Active 

Type: {Capture, Track } ty -23 

Initial Value: UNDEFINED 
Classified as: State 

:= Offside_ALTSEL_Active v _i42 if not Is_This_Side_Active v _3o 


Undefined 


Capture 


if 


True 


Capture 


Track 


Track„ALTSEL m .78() 


Purpose: This variable maintains the current state of Altitude Select mode when 

it is active, i.e., whether it is captured or tracking. Note that if this side of the FGS 
is not active, it obtains its value from the off side. The normal transitions occur only 
when this side is active. 
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2. 7.2. 6 Vertical Approach (VAPPR) Mode 

In Vertical Approach mode, the FGS provides guidance commands to track vertical guidance for 
ILS precision Glideslope approaches. Vertical Approach is an arming mode. i.e.. after being 
selected, it must remained armed for a period of time before it can become active. 


Definitions of Values to be Imported 


Macro 


Select_VAPPR 


Condition: When_APPR-Switch_Pressed_Seen m _n5() 

Purpose: This event defines when Vertical Approach mode is to be selected. 


Macro 


Activate.VAPPR 


Condition: 

T 
T 
Y 

Purpose: This event defines when Vertical Approach mode is to transition from the armed to 

the active state. 


A 

N 

D 


When-VAPPR-Track_Cond_Met_Seen m -990 


Is_LAPPR_Active v .i 


V-52 


Overspeed_Condition m .i 28 () 
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Macro 


Deselect TVAPPR 


Condition: 


OR 


When_APPR _Switch_Pressed_Seen m - 115 ( ) 


T 






When(IsJLAPPR_Selected v _52 =False) 



T 





When_Select,ed_Nav _Source_Changed v - i 27 




T 




When_Selected-Nav_Frequency_Chaiiged v -i 27 





T 



WlieioP ilot _F lying_Transfer m _29 ( ) 






T 


When(Modes v -34 =Off) 







T 


Purpose: This event defines when Vertical Approach mode is to be deselected, i.e.. to be 

cleared regardless of whether it is armed or active. 


Macro 


Deactivate VAPPR 


Condition: 


Purpose: This event defines when Vertical Approach mode is to be cleared if it is active, but 
to remain armed if it is armed. 


When_N onbasic _Vert icaLMode.Acti vated m _ 60 () 


T 
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Definitions of Values to be Exported 


State Variable 


Is_VAPPR_Selected 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 

:= (VAPPR. v _89 =Selected) if True 


Purpose: Indicates if VAPPR mode is selected. 


State Variable 


Is_VAPPR_Active 


Parent: None 

Type: Boolean 

Initial Value: False 

Classified as: CONTROLLED 

: = (VAPPR_Selected v -9o = Active) if True 


Purpose: Indicates if VAPPR mode is active. 
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Macro 


WhenJVAPPFCActivated 


Condition: 


T 
T 
T 

Purpose: This signal occurs when Vertical Approach mode is activated. 

Comment: This event is defined this way to avoid circular dependencies. It would be 
preferable to define it as When (VAPPR .Selected = Active). 


A Activate_VAPPR m _85() 

^ Previous STEP(VAPPR_Select,ed v -9o) = Armed 
Is_This_Side_Active v _ 3 o 
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Definitions of Values to be Encapsulated 


State Variable 



VAPPR 



Parent: Modes v -34-On 

Type: {Cleared. Selected } ty -23 

Initial Value: Undefined 
Classified as: State 

:= Offside_VAPPR v _i43 if not Is_This_Side_Active v _3o 


Undefined 


Cleared if 


A 

N 

D 


Select_VAPPR m _ 85 () 


Is_This_Side_Active 


v-30 


Undefined 


Selected if 


A 

N 

D 


Select JVAPPR m _85() 


Is_This_Side_Active. 


v-30 


F 

T 


T 

T 


Cleared 


Selected if 


N Select -V APPR n i _ 85 ( ) 

D Is_This_Side_Active v .3o 


T 

T 


Selected 


Cleared 


if 


A 

N 

D 


Deselect _VAPPR m .86() 
Deactivate_VAPPR m .86() 

Previous STEP(VAPPR_Selected v . 9 o) ^Active 
Is-This_Side_Active v .3o 


OB 


T 



T 


T 

T 

T 


Purpose: This variable maintains the current base state of Vertical Approach 

mode, i.e., whether it is cleared or selected. Note that if this side of the FGS is not 
active, it obtains its value from the off side. The normal transitions occur only when 
this side is active. 
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State Variable 


VAPPFCSelected 


Parent: Modes v .34.0n t> VAPPR v -89- Selected 

Type: {Armed, Active} ty -23 
Initial Value: UNDEFINED 
Classified as: State 

:= Offside_VAPPR_Selected v _i 43 if not Is_This_Side_Active v _3o 


Undefined 


Armed if True 


Armed 


A 

N 

D 


Active if 


Aetivate_VAPPR m -85() 


Is_This_Side_Act i ve v . 


30 



T 


T 


Purpose: This variable maintains the current state of Vertical Approach mode 
when it is selected, i.e., whether it is armed or active. Note that if this side of the 
FGS is not active, it obtains its value from the off side. The normal transitions 
occur only when this side is active. 
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2. 7.2. 7 Vertical Go Around (VGA) Mode 

Go Around mode provides guidance to the pilot after aborting an approach. The AP is never 
engaged during Go Around mode. Vertical Go Around mode provides guidance to maintain a 
fixed pitch angle. 


Definitions of Values to be Imported 


Macro 


Select _VG A 


Condition: 

A 

N 

D 


Purpose: This event defines when Vertical Go Around mode is to be selected. 


When_GAJ3witch_Pressed_Seen m _ii6() 


T 

Overspeed_Condition m .i 28 () 


F 


Macro 


Deselect.VGA 


Condition: 


on 


A 

N 

D 


When( APv-i32 =Engaged) 



□ 

□ 

□ 

□ 

□ 

F 

Wlien_Noiibasi(cLateraLMode_Activated ni . 35 () 

1 

e 

i 

l: 

1 

1 ! 

Si 

a 

WhenJNonbasic_Vertical_Mode_Activated m _6o() 




T 





When_SYNC-Switch_Pressed_Seen m _n70 





T 




Wheii_VSJPitch_WheeLRotated_Seen m _iio() 






T 



When_Pilot_Flying_Transfer m .29 ( ) 







T 


When(Modes v -34 =Off) 








T 


Purpose: This event defines when Vertical Go Around mode is to be deselected. 
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Definitions of Values to be Exported 


State Variable 


Is_VGA_Selected 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 
:= (VGAy-94 ^Selected) if True 


Purpose: Indicates if VGA mode is selected. 


State Variable 


IsLVGA.Active 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 
:= (VGAy-94 =Selected) if True 


Purpose: Indicates if VGA mode is active. 

Comment: Even though VGA Selected and VGA Active are the same value, this 

is defined to provide a common set of controlled variables across all modes. 
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Macro 


When_VGA_Activated 


Condition: 


Select_VGA m _ 9 i () 


T 

Previous Step(VGA v _ 94 ) ^Selected 


F 

Is_Tliis_Side_Active v -3o 


T 


Purpose: This signal occurs when Vertical Go Around mode is activated. 


Comment: This event is defined this way to avoid circular dependencies. It would be 
preferable to define it as When(LGA = Selected). 
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Definitions of Values to be Encapsulated 


State Variable 



VGA 



Parent: Modes v -34.0n 

Type: {Cleared, Selected }t y -23 

Initial Value: Undefined 
Classified as: State 

:= Offside. VGA v . 144 if not Is_This_Side_Active v -3o 


Undefined 


Cleared if 


A 

N 

D 


Select _V G A m _g i ( ) 


Is.This_Side.Active 


v-30 


Undefined 


Selected | if 


Cleared 


A 

N 

D 


A 

N 

D 


Select _VGA 


m-91 


0 


Is-Tliis_Side-Active v .; 


v-30 


Selected if 


Select_VGA m .9i () 


Is_This_Side_Active 


V-30 


Selected 


Cleared if 


A 

N 

D 


Deselect -VGA m _ 91 () 


T 

Is_This_Side_Active v -3o 


T 


Purpose: This variable maintains the current state of Vertical Go Around mode. 

Note that if this side is not active, it obtains its value from the off side. The normal 
transitions for Vertical Go Around mode occur only when this side is active. 
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2.8 Flight Control Laws 


The Flight Control Laws generate the pitch and roll guidance commands provided to the Flight 
Director and the Autopilot. Different Flight Control Laws are armed or activated based on the 
current modes of the FGS. They also provide inputs to the mode logic that determine when 
transitions are made from the armed to the active state. While the Flight Control Laws are not 
specified in this model, this component defines the interface between them and the mode logic 
and defines the events provided by the Flight Control Laws that the mode logic depends upon. 
As with events provided by the Flight Control Panel, some of these are prioritized so that if 
multiple events occur at the same time, only the most significant events are seen by the other 
parts of the specification. 


Definitions of Values to be Exported 


Macro 


When_NAV_Track_Cond_Met 


Condition: Is_NAV-Track_Cond_Metj v -ioo 

Purpose: This event indicates when the NAV Track Condition is met. 
Comment: This is redefined as a macro to simplify verification. 


Macro 


When_N AV_Track_Cond_Met _Seen 


Condition: 

T 

T 

Purpose: This event indicates when the NAV Track condition is met and no higher priority 
event has occurred. 


WhemN AV ATrack_Cond_Met m _95 ( ) 


No_Higher .Event _Than_N AV_Track-Cond_Met m _96 ( ) 
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Macro 


No_Higher_Event_Than_NAV_Track_Cond_Met 


Condition: 


When_FD_Switch_Pressed m oo3() 


F 

No_Higher_Event-Than_FD_Switch_Pressed m -io<]() 


T 


Purpose: This event occurs when no event with a priority higher than pressing the NAV 
switch has occurred. 


Macro 

When_ALTSEL .Track Cond.Met 

Condition: Is_ALTSELTTrack_Cond_Metj v _ioi 

Purpose: This event indicates when the ALTSEL Track Condition is met. 
Comment: This is redefined as a macro to simplify verification. 


Macro 


When_ALTSEL Track_CondJMet_Seen 


Condition: 

A 

N 

D 

Purpose: This event indicates when the ALTSEL Track condition is met and no higher 
priority event has occurred. 


When_ALTSEL_Track_Cond_Met m _96 ( ) 

T 

No_Higher_Event_Than_ALTSEL_Track_Cond_Met m . 97 () 

T 
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Macro 


No_Higher .Event _Than„ALTSEL_Track.Cond_Met 


Condition: 

A 

N 

D 

Purpose: This event occurs when no event with a priority higher than pressing the FD switch 
has occurred. 


WhemFD _Switch_Pressed m _i03 ( ) 


F 

No_Higher_Event_Than_FD_Switch_Pressed m _io4() 


T 


Macro 

When_ALTSEL_Capture_Cond_Met 

Condition: Is.ALTSEL-Capture_Cond_Metj v -ioi 

Purpose: This event indicates when the ALTSEL Capture Condition is met. 
Comment: This is redefined as a macro to simplify verification. 


Macro 


When.ALTSEL_Capture_Cond.Met .Seen 


Condition: 

A 

N 

D 

Purpose: This event indicates when the ALTSEL Capture condition is met and no higher 
priority event has occurred. 


When_ALTSEL_Capture_Cond_Met m _ 97 () 

T 

No_Higher_Event_Than_ALTSEL_Capture_Cond_Met m .98() 

T 
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Macro 


No_Higher_Event_Than_ALTSEL_Capture„Cond_Met 


Condition: 

A 
N 
D 

Purpose: This event occurs when no event with a priority higher than pressing the FD switch 
has occurred. 


When_FD_Switeh_Pressed m -io3() 


F 

No_Higher_Event_Than_FD_Switch_Pressed m .io4() 


T 


Macro 

WhenJLAPPR_Track Cond_Met 

Condition: Is_LAPPR_Track_Cond_Metj v -ioi 

Purpose: This event indicates when the LAPPR Track Condition is met. 
Comment: This is redefined as a macro to simplify verification. 


Macro 


When_LAPPR_Track_Cond Met_Seen 


Condition: 

A 

N 

D 

Purpose: This event indicates when the LAPPR Track condition is met and no higher 
priority event has occurred. 


When_L APPR _Track_Coiu LMet m-98 ( ) 


T 

No_Higher_Event_Than_LAPPR_Traok_CondAlet m _Qg() 


T 
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Macro 


No_Higher_Event_Than_LAPPR_Track_ConcLMet 


Condition: 

A 

N 

D 

Purpose: This event occurs when no event with a priority higher than pressing the FD switch 
lias occurred. 


When_FD_Switch_Pressed m _io 3 () 


F 

NoJiigher_Event_Than_FD_Switch_Pressed m _io4() 


T 


Macro 

When_VAPPR_Track_Cond_Met 

Condition: Is_VAPPR_Track_CondJVIetj v _io2 

Purpose: This event indicates when the VAPPR Track Condition is met. 
Comment: This is redefined as a macro to simplify verification. 


Macro 


WhenFVAPPRAIYack Cond Met JSeen 


Condition: 

A 
N 
D 

Purpose: This event indicates when the VAPPR Track condition is met and no higher 
priority event has occurred. 


When JVAP P R _Track_Cond_Met m .99 ( ) 


T 

No_Higher_Event_Than_VAPPR_Track_Cond_Met m -ioo() 


T 
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Macro 


No_Higher_Event-Than_VAPPR_Track_Cond_Met 


Condition: 


When -FD .Switch _P ressed m _ 1 03 ( ) 


F 

No-Higher _Event_Than.FD.Switch_Pressed m .io4() 


T 


Purpose: This event occurs when no event with a priority higher than pressing the FD switch 
has occurred. 


Definitions of Values to be Encapsulated 


Input Variable 


Is_NAV_Track_Cond_Met 


Type: Boolean 
Initial Value: False 
Classified as: MONITORED 

Purpose: This input variable becomes true when the lateral navigation (NAY) flight control 
law transitions from the armed to the track state. 


100 






Input Variable 


Is_ALTSEL_Capture_Cond_Met 


Type: Boolean 
Initial Value: False 
Classified as: MONITORED 

Purpose: This input variable becomes true when the vertical altitude select flight control law 
transitions from the armed to the capture state. 


Input Variable 


Is_ALTSEL„Track_Cond_Met 


Type: Boolean 
Initial Value: FALSE 
Classified as: MONITORED 

Purpose: This input variable becomes true when the vertical altitude select flight control law 
transitions from the capture to the track state. 


Input Variable 


Is_LAPPR_Track_Cond_Met 


Type: Boolean 
Initial Value: False 
Classified as: MONITORED 

Purpose: This input variable becomes true when the lateral approach (LAPPR) flight control 
law transitions from the armed to the track state. 
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Input Variable 


Is_VAPPR_Track^Cond_Met 


Type: Boolean 
Initial Value: False 
Classified as: MONITORED 

Purpose: This input variable becomes true when the vertical approach (VAPPR) flight 
control law transitions from the armed to the track state. 
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2.9 Flight Control Panel (FCP) 

The Flight Control Panel (FCP) is the primary device with which the flight crew interacts with 
the FGS. This component defines the FGS’s view of the FCP. This consists of the definition of 
the monitored variables representing the switches and dials of the FCP and the controlled 
variables representing the lamps displayed on the FCP. A few additional inputs, such as the 
SYNC and AP Disengage switches on the control yokes and the GA switches on the throttles, 
are routed through the FCP aand are defined here. This component also defines FCP specific 
events, such as the pressing of a switch, used in the rest of the specification. These events are 
prioritized so that if multiple events occur at the same time, only the most significant events are 
seen by the other parts of the specification. 


Definitions of Values to be Exported 


Macro 


When_FD_Switch_Pressed 


Condition: When(FD_Switchj v -ii8 =ON) 

Purpose: This event indicates when the FD switch associated with this FGS is pressed. 
Comment: This is redefined as a macro to simplify verification. 


Macro 


When_FD_Switch_Pressed_Seen 


Condition: 

A 
N 
D 

Purpose: This event occurs when the FD Switch is pressed and no higher priority event has 
occurred. 


When_FD_Switch_Pressed m -io3() 


T 

No_Higher_Event_Than_FD_Switch_Pressed m -io4() 


T 
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Macro 


No Higher _Event_Than_FD_Switch_Pressed 


Condition: 

A 
N 
D 

Purpose: This event occurs when no event with a priority higher than pressing the FD switch 
has occurred. 


When_TransfeicSwitch_Pressed m _io 4 () 


F 

No_Higher_Event_Than-Transfer-Switch_Pressed m _io5() 


T 


| Macro 

WhenATransfer_SwitchhPressed 

Condition: When(Transfer_Switch iv . 12 5 =ON) 

Purpose: This event indicates when the TRANSFER switch ais pressed. 
Comment: This is redefined as a macro to simplify verification. 


Macro 


When-Transfer .Switch -Pressed -Seen 


Condition: 


When_Transfer_SwitclnPressed m . io4 () 


T 

No_Higher_Event_Thaii-Transfer-Switch-Pressed m .io5() 


T 


Purpose: This event indicates when the Transfer switch is pressed and no higher priority 
event has occurred. 
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Macro 


No_Higher_Event.Than_Transfer_Switch_Pressed 


Condition: 


When_AP_Engage_Switch_Pressed m _io5() 


F 

No_Higher-Event-Than_AP-Engage-Switch_Pressed m .io6() 


T 

When _ VS _P i t cli .Wheel -Rot ated m _ 1 09 ( ) 


F 

No_Higher-Event_Than_VS_Pitch_WheeLRotated m .iio() 


T 

When_NAV_SwitchT > ressed n> io7() 


F 

No-Higher _Event_Than_NAV.Switch_Pressed m .io8() 


T 


Purpose: This event occurs when no event with a priority higher than pressing the Transfer 
switch has occurred. 


Macro 

When_AP.Engage_Switch_Pressed 

Condition: When(AP.Engage_Switchi v _i26 =ON) 

Purpose: This event indicates when the AP Engaged switch is pressed. 
Comment: This is redefined as a macro to simplify verification. 
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Macro 


When_AP_Engage_Switch_Pressed_Seen 


Condition: 


When_AP_Engage_S witch _Pressed m .io 5 () 


No_Higher_Event .Than _AP_Engage.S wit ch_Pressed n> 106 ( ) 



T 

T 


Purpose: This event indicates when the AP Engage switch is pressed and no higher priority 
event has occurred. 


Macro 


No.Higher. Event Than APJEngage.Switch.Pressed 


Condition: 

A 
N 
D 

Purpose: This event occurs when no event with a priority higher than pressing the AP 
Engage switch has occurred. 


When.AP. Disconnects witch_Pressed in . loo () 


F 

No_Higher_Event-Than_AP_Disconnect_S witch _Pressed m -io 7 () 


a 


Macro 

Wlien_AP_Discoimect_Switch_Pressed 

Condition: Wlien(AP JDisconnect_Switchi v _i26 =ON) 

Purpose: This event indicates when the AP Disconnect switch is pressed. 
Comment: This is redefined as a macro to simplify verification. 
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Macro 


When_AP_Disconnect_Switch_Pressed_Seen 


Condition: 

A 
N 
D 

Purpose: This event indicates when the AP Disconnect switch is pressed and no higher 
priority event has occurred. 


When_AP_DisconnectJ3witch_Pressed m .io6() 


T 

No_HigherJ3vent_Than_APJDisconnectJSwitch_Pressed n> io7() 


T 


Macro 


NoJHigher .Event _Than_AP -Disconnect _Switch_Pressed 


Condition: True 

Purpose: This event occurs when no event with a priority higher than pressing the AP 
Disconnect switch has occurred. 


Lateral Switches 


Macro 


When_NAV_Switch^Pressed 


Condition: When(NAV_Switchi v -ii9 =ON) 

Purpose: This event indicates when the NAV switch is pressed. 
Comment: This is redefined as a macro to simplify verification. 
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Macro 


When_NAV_Switch_Pressed_Seen 


Condition: 

A 

N 

D 

Purpose: This event indicates when the NAY Switch is pressed and no higher priority event 
has occurred. 


When_NAV_S witch J > ressed m _io7() 


T 

No_Higher_Event_Than_NAV_Switch_Pressed m _io8() 


T 


Macro 


No Higher Event .Than NAV.SwitchAPressed 


Condition: 


When.HD G _S wi t ch _P ressed m . i os ( ) 


F 

No_Higher-Event_Than_HDG_S\vitch_Pressed n> io90 


T 


Purpose: This event occurs when no event with a priority higher than pressing the NAV 
switch has occurred. 


Macro 

When.HDG.Switch Pressed 

Condition: When(HDG_Switchj V .n8 =ON) 

Purpose: This event indicates when the HDG switch is pressed. 

Comment: This is redefined as a macro to simplify verification. 
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Macro 


When_HDG.Switch_Pressed_Seen 


Condition: 

A 
N 
D 

Purpose: This event indicates when the NAV Switch is pressed and no higher priority event 
has occurred. 


When_HDG_Switch_Pressed m _io 8 () 


T 

No.Higher_Event.Than_HDG_Switch_Pressed n> io 9 () 


T 


Macro 


No_Higher .Event _Than_HDG_Switcli_Pressed 


Condition: 

A 
N 
D 

Purpose: This event occurs when no event with a priority higher than pressing the HDG 
switch has occurred. 


When.APPR_Switch_Pressed m -i () 


F 

No-Higher_Event_Than_APPR_Switch_Pressed ni _n5() 


T 


Vertical Switches 


Macro 


When_VS_Pitch_Wheel_Rotated 


Condition: \Vhen(VS_Pitch_Wlieel JnJVlotionj v _i25) 

Purpose: This event indicates when the VS Pitch Wheel is rotated. 
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Macro 


When_VS, Pitch. Wheel-Rotated -Seen 


Condition: 

A 
N 
D 

Purpose: This event indicates when the VS Pitch Wheel is rotated and no higher priority 
event has occurred. 


When-VS-Pitch_WheeLRotated m -io9() 


T 

No-Higher _E vent _Than_VS_Pitch_Wheel_Rotated rn _iio() 


T 


Macro 


No Higher Event -Than VS _Pitcli Wheel-Rotated 


Condition: 


When_VS-Switch-Pressed m _iio() 


F 

No-Higher _Event-Than-VS-Switch_Pressed m .ni() 


T 


Purpose: This event occurs when no event with a priority higher than rotating the VS Pitch 
Wheel has occurred. 


1 Macro" 

When-V S_Switch_Pressed 

Condition: When(VS_Switchj v _i 2 o =ON) 

Purpose: This event indicates when the VS switch is pressed. 
Comment: This is redefined as a macro to simplify verification. 
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Macro 


When_VS-Switc.h_Pressed-Seen 


Condition: 

A 
N 
D 

Purpose: This event indicates when the VS switch pressed and no higher priority event has 
occurred. 


When. VS -Switch-Pressed m _i i o ( ) 


T 

No_Higher_Event_Than_VS_Switch_Pressed ni .iii() 


T 


Macro 


No-Higher_Event_Than_VS_Switch_Pressed 


Condition: 

A 

N 

D 

Purpose: This event occurs when no event with a priority higher than pressing the VS switch 
has occurred. 


When_FLC_Switch_Pressed m _in() 


F 

No-Higher _E vent -Than_FLC-Switch_Pressed m . 112 () 


T 


| Macro [ 

When_FLC_Switch_Pressed 

Condition: When(FLC_Switchi v -i22 =ON) 

Purpose: This event indicates when the FLC switch is pressed. 
Comment: This is redefined as a macro to simplify verification. 
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Macro 


When_FLC_Switcli.Pressed Seen 


Condition: 

A 
N 
D 

Purpose: This event indicates when the FLC switch pressed and no higher priority event has 
occurred. 


When_FLC_S witch J’ressedm-i 11 () 


T 

No_Ffigher .Event .Than _FLC_Switch_Pressed m _ii2() 


T 


Macro 


No Higher. Event _Than.FLC.Switch.Pressed 


Condition: 


When _ ALT .S wi t ch _Pressed m _ 1 1 2 ( ) 

[f 

No_Higher_Event_Than_ALT_Switch_Pressed m _ii 3 () 

rf 


Purpose: This event occurs when no event with a priority higher than pressing the FLC 
switch has occurred. 


[ Macro 

When. ALT .S wit chJPressed 

Condition: When(ALT_Switchj v _i2i =ON) 

Purpose: This event indicates when the ALT switch is pressed. 
Comment: This is redefined as a macro to simplify verification. 
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Macro 


When. ALT_Switch_Pressed .Seen 


Condition: 

T 
T 

Purpose: This event indicates when the ALT switch pressed and no higher priority event has 
occurred. 


When_ALT_S wit ch_Pressed m . 1 12 ( ) 


No_Higher .Event _Than_ALT_S witch_Pressed m . 1 1 3 ( ) 



Macro 


No_Higher_Event_Than_ALT_Switch_Pressed 


Condition: 


When_ALTSEL_Target_Altitude_Changed m _n3() 

F 

No_Higher_Event_Than_ALTSEL_Target_Altitude_Changed m _ii4() 

T 


Purpose: This event occurs when no event with a priority higher than pressing the ALT 
switch has occurred. 


Macro 


When_ALTSEL_Target_Altitude_Changed 


Condition: 


A 

N 

D 


ALTSEL_Target-Altitude_Changedj v .i29 =Undefined 


ALTSEL_Target AltitudeX'hangedjv -129 


F 

T 


Purpose: 


This event indicates when the ALTSEL target altitude is changed. 
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Macho 


When. ALTSEL_Target .Altitude Changed.Seen 


Condition: 

A 
N 

D 

Purpose: This event indicates when the ALTSEL target altitude is changed and no higher 
priority event has occurred. 


When_ALTSEL_Target_Altitude_Changed m _ii 30 

T 

No.Higher_Event.Than_ALTSEL_Target-Altitude_Changedm.ii 4 0 

T 


Macro 


No Higher.Event .Than. ALTSEL Target .Altitude Changed 


Condition: 

A 

N 

D 

Purpose: This event occurs when no event with a priority higher than rotating the changing 
of the ALTSEL target altitude has occurred. 


When_APPR_Switch_Pressed m _i 14 () 


F 

No.Higher .Event .Than .APPR_Switch_Pressed m . H 5 0 


T 


Lateral and Vertical Events 


Macro 


When. APPR.S witch Pressed 


Condition: When(APPR_Switchi v -i23 = 0 N) 

Purpose: This event indicates when the APPR switch is pressed. 
Comment: This is redefined as a macro to simplify verification. 
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Macro [ 


When_APPR_Switcli_Pressed_Seen 


Condition: 


When.APPR_Switch_Pressed m -i 14 () 


Pf 

No_Higher_Event_Than_APPR_Switch_Pressed m _ii5() 


T 


Purpose: This event indicates when the APPR switch pressed and no higher priority event 
has occurred. 


Macro 


No_Higher_Event_Than_APPR_S witch .Pressed 


Condition: 

J 

T 

Purpose: This event occurs when no event with a priority higher than pressing the APPR 
switch has occurred. 


When _G A .Switch _P ressed m . 1 1 5 ( ) 


No-Higher_Event_Than_GA_Switch_Pressed m .]26() 



Macro 


When_GA_Switch_Pressed 


Condition: When(GA_Switchj v -i 24 =ON) 

Purpose: This event indicates when the GA switch is pressed. 
Comment: This is redefined as a macro to simplify verification. 


115 




Macro 


When_GA_Switch_Pressed_Seen 


Condition: 


When_GA_Switch_Pressed m .ii50 


T 

No-Higher J3vent_Than_GA_Switch_Pressed m _ii6() 


T 


Purpose: This event indicates when the GA switch pressed and no higher priority event has 
occurred. 


Macro 


No .Higher ^Event _Than GA_Switch_Pressed 


Condition: 

A 
N 

D 

Purpose: This event occurs when no event with a priority higher than pressing the GA switch 
has occurred. 


\Yhen_SYNC_Switch_Pressed m _n6() 

[f 

No_Higher_Event_Tlian_SYNC-Switcli_Pressed m _n 7 () 

[t 


Macro 


When_SYNC_SwitchhPressed 


Condition: When(SYNC_Switchj v -i 25 =ON) 

Purpose: This event indicates when the SYNC switch is pressed. 
Comment: This is redefined as a macro to simplify verification. 
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Macro 


When_SYNC_Switch_Pressed_Seen 


Condition: 

A 
N 
D 

Purpose: This event indicates when the SYNC switch pressed and no higher priority event 
has occurred. 


When_SYNC_Switch_Pressed m _ii6() 


T 

No_Higher _Event _Than_S YN C_Switch_Pressed n> 1 1 7 ( ) 


T 


Macro 


No_Higher_Event_ThanJ3YNC_Switch_Pressed 


Condition: True 

Purpose: This event occurs when no event with a priority higher than pressing the GA switch 
has occurred. 


Definitions of Values to be Encapsulated 


Type 


Switch 


Possible Values: OFF. ON 
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J Type L 


Lamp 


Possible Values: OFF. ON 



Input Variable 



FD_S witch 



Type: {OFF. ON} ty .ii 7 
Initial Value: UNDEFINED 
Classified as: MONITORED 

Purpose: Holds the last sensed position of the FD switch associated with this FGS. 



Input Variable 



HDG.S witch 



Type: {OFF. ON} ty -ii7 

Initial Value: UNDEFINED 
Classified as: MONITORED 

Purpose: Holds the last sensed position of the HDG switch. 
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State Variable 


HDG_Lamp 


Parent: None 

Type: {OFF, ON} ty . 118 
Initial Value: OFF 
Classified as: CONTROLLED 
:= ON if Is.HDG-Selected v . 4 i 

:= OFF if not Is.HDG.Selected v -4] 


Purpose: Indicates if the HDG switch lamp on the FCP should be on or off. ' 


Input Variable 


NAV.S witch 


Type: {OFF. ON} ty .ii7 
Initial Value: Undefined 
Classified as: MONITORED 

Purpose: Holds the last sensed position of the NAV switch. 
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State Variable 


NAVJLamp 


Parent: None 

Type: {OFF. ON} ty -ii8 
Initial Value: OFF 
Classified as: CONTROLLED 

:= ON if Is_NAV_Selected v -46 
:= OFF if not Is_NAV_Selected v -46 


Purpose: Indicates if the NAV switch lamp should be on or off. 


Input Variable 


VS Switch 


Type: {OFF. 0N} ty _ m 
Initial Value: UNDEFINED 
Classified as: MONITORED 

Purpose: Holds the last sensed position of the VS switch. 


120 



State Variable 


VS .Lamp 


Parent: None 

Type: {OFF, ON} ty _ 118 
Initial Value: OFF 
Classified as: CONTROLLED 

:= ON if Is_VS_Selected v -66 

:= OFF if not Is_VS_Selected v _66 


Purpose: Indicates if the VS switch lamp should be on or off. 


Input Variable 


ALT .Switch 


Type: {OFF, ON} ty .ii7 
Initial Value: UNDEFINED 
Classified as: MONITORED 

Purpose: Holds the last sensed position of the ALT switch. 
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State Variable 


ALT .Lamp 


Parent: None 

Type: {OFF, ON } ty . 118 
Initial Value: OFF 
Classified as: CONTROLLED 

:= ON if Is_ALT_Selected v _74 

:= OFF if not Is.ALT_Selectedy.74 


Purpose: Indicates if the ALT switch lamp should be on or off. 


Input Variable 


FLC_Switcli 


Type: {OFF. ON} ty -ii 7 

Initial Value: UNDEFINED 
Classified as: MONITORED 

Purpose: Holds the last sensed position of the FLC switch. 
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State Variable 


FLCJLamp 


Parent: None 

Type: {OFF, ON} ty _ U8 
Initial Value: OFF 
Classified as: CONTROLLED 

:= ON if Is_FLC_Selected v .7o 

:== OFF if not Is_FLC_Selected v _ 7 o 


Purpose: Indicates if the FLC switch lamp should be on or off. 


Input Variable 


APPRJ3 witch 


Type: {OFF. ON} ty _n 7 

Initial Value: Undefined 
Classified as: MONITORED 

Purpose: Holds the last sensed position of the APPR switch. 
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State Variable 


APPR_Lamp 


Parent: None 


Type: {OFF, ON } ty _ U8 

Initial Value: OFF 
Classified as: CONTROLLED 
:= ON if 


OB 


Is_LAPPR_Selected v _52 


T 


Is-VAPPR-Selectedv-87 



T 


:= OFF if 


Is_LAPPR_Selected v _ 5 2 


F 

IsJVAPPR _Selected v _87 


F 


Purpose: Indicates if the APPR switch lamp should be on or off. 


Input Variable 


GA_Switch 


Type: {OFF. ON } ty _ 117 

Initial Value: UNDEFINED 
Classified as: MONITORED 

Purpose: Holds the last sensed position of the GA switch. 
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Input Variable 


SYNC .Switch 


Type: {OFF, ON} ty _ m 
Initial Value: Undefined 
Classified as: MONITORED 

Purpose: Holds the last sensed position of the SYNC switch. 


Input Variable 


Transfer. Switch 


Type: {OFF, 0N} ty . 117 
Initial Value: Undefined 
Classified as: MONITORED 

Purpose: Holds the last sensed position of the TRANSFER switch. 


Input Variable 


VS.Pitch.WheeLIn.Motion 


Type: BOOLEAN 

Initial Value: Undefined 

Classified as: MONITORED 

Purpose: Holds the last sensed position of the VS/Pitch wheel. 
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Input Variable 


AP_Engage_S witch 


Type: {OFF, ON} ty _ m 
Initial Value: UNDEFINED 
Classified as: MONITORED 

Purpose: Holds the last sensed position of the AP Engage switch. 


State Variable 


AP_Lamp 


Parent: None 

Type: {OFF. ON} ty _ 118 

Initial Value: OFF 
Classified as: CONTROLLED 
:= ON if Is_AP_Engaged v _i3i 

:= OFF if not Is_AP_Engaged v _i3i 


Purpose: Indicates if the AP switch lamp should be on or off. 


Input Variable 


AP_Disconnect_Switch 


Type: {OFF, ON} ty . 117 

Initial Value: UNDEFINED 
Classified as: MONITORED 

Purpose: Holds the last sensed position of the AP Disconnect switch. 
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2.10 Navigation Sources 


The FGS receives navigation information from several sources, including VHF Omni-Directional 
Range (VOR) for lateral navigation, Localizer (LOC) for precision lateral approach, and 
Glideslope (GS) for precision vertical approach. This component defines the FGS’s view of its 
navigation sources. This includes definition of the types of sources available, the currently 
selected source, and the information available from that source. 


Definitions of Values to be Exported 


State Variable 


When_Selected_Nav_Source-Clianged 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: MONITORED 

Purpose: This event occurs when a new navigation source is selected. 


State Variable [. 


When_Selected_Nav -Frequency -Changed 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: MONITORED 

Purpose: This event occurs when the frequency of the selected navigation source is changed. 
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2.11 Air Data System 


The Air Data System provides information about the aircraft state sensed from the surrounding 
air mass such as whether an overspeed condition exists. This component defines the FGS’s view 
of the Air Data System. 


Definitions of Values to be Exported 


J Macro 


Overspeed_Condition 


Condition: 


A 

N 

D 


Overspeedjv-128 7^U NDEFINED 
Overspeedj v -i 28 =TRUE 



Definitions of Values to be Encapsulated 


Input Variable 


Overspeed 


Type: Boolean 

Initial Value: UNDEFINED 

Classified as: MONITORED 

Purpose: This state variable indicates if an overspeed condition exists. 
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2.12 References 


References refer to target values used by several of the inodes, such as the Preselected Altitude. 
These may be set by the flight crew through the Flight Control Panel, or set to the current 
aircraft value on entry to a mode or a synchronization request. The references may be 
physically maintained by a variety of systems. This component defines the FGS’s view of the 
references. Details of how these values are obtained from other systems are encapsulated within 
this component. 


Definitions of Values to be Exported 


Input Variable 


ALTSEL_Target _Altitude_Changed 


Type: Boolean 
Initial Value: True 
Classified as: MONITORED 

Purpose: This input variable holds the most recent information on whether the ALTSEL 

target altitude (either the PSA or FPTA) has been changed. 
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2.13 Autopilot (AP) 

The Autopilot (AP) commands movement of the control surfaces based on the pitch and roll 
commands generated by the FGS. This component defines the FGS s view of the AP. 

Definitions of Values to be Imported 


Macro 

When_Engage_AP 

Condition: When.AP_Engage_Switch_Pressed_Seen m .io6() 
Purpose: This event defines when the AP is to be engaged. 


Macro 


When_Disengage_AP 


Condition: 


OR 


When_AP_Engage_Switch_Pressed_Seen m _io6 ( ) 


T 



When_AP_Diseonneet_Switeh_Pressed_Seen m _i07() 



T 


\VhemGA_Switeh_Pressed_Seeii m _iie() 




T 


Purpose: This event defines when the AP is to be disengaged. 
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Is_AP .Engaged 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: CONTROLLED 
:= (AP v -i32 = Engaged) if True 

Purpose: Indicates if the AP is engaged. 



AP -State 


Possible Values: Disengaged. Engaged 
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State Variable 


AP 


Parent: None 


Type: {Disengaged, Engaged } ty -i 31 

Initial Value: Disengaged 
Classified as: State 


Disengaged 



Engaged 



- 

Engaged 



Disengaged | 


if 


When_Engage_AP n >i3o() 
When _D isengage_AP m . 1 30 ( ) 


Purpose: This variable maintains the current state of the autopilot. 
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2.14 Offside FGS 


The FGS has two physical sides, or channels, on the left and right sides of the aircraft. These 
provide redundant implementations that communicate with each other over a cross-channel bus. 
This component defines this side of the FGS’s view of the other side. 


Definitions of Values to be Exported 


State Variable 



Offside_FD 



Parent: None 

Type: {Off. On} ty -23 
Initial Value: Off 
Classified as: MONITORED 
:= Off if not Offside _FD_Oiii v -i45 

:= On if O ff s i de _F D _ 0 n i v- 1 4 5 


Purpose: This variable holds the most recent information on the state of the FD 

on the offside FD. 
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State Variable 


Is_Offside_LAPPR Active 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: MONITORED 

:= Offside A APPR_Selected v _ i38 = Active if TRUE 


Purpose: Indicates if offside LAPPR mode is active. 


State Variable 


Is_Offside_VAPPR_Active 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: MONITORED 

:= Offside_VAPPR_Selected v -i43 =Active if True 


Purpose: Indicates if offside VAPPR inode is active. 
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State Variable 


Is_OfFside_VGA_Active 


Parent: None 

Type: Boolean 
Initial Value: False 
Classified as: MONITORED 

:= Offside.VG Ay-144 ^Selected if True 


Purpose: Indicates if offside VGA mode is active. 


State Variable 


Offside_Modes 


Parent: None 

Type: {Off. On} ty _ 23 
Initial Value: Off 
Classified as: MONITORED 
:= Off if not Offside_Modes_Onj v _i45 

:= On if Offside -Modes_Oiiiv- 145 


Purpose: This variable holds the most recent information on the state of the 

mode annunciations on the offside FGS. 
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State Variable 


Offside_ROLL 


Parent : Offside_Modes v - 135 . On 

Type: {Cleared. Selected } ty -23 

Initial Value: Undefined 

Classified as: MONITORED 

:= Cleared if not Offside_RolLSelectedj v _i45 

:= Selected if Otfside_RolLSelected lv -i45 

Purpose: This variable holds the most recent information on the base state of the 
lateral ROLL mode of the offside FGS. 


State Variable 


Offside.HDG 


Parent: Offside _Modes v -i35-On 

Type: {Cleared. Selected } ty -23 

Initial Value: Undefined 

Classified as: MONITORED 

:= Cleared if not OfFside_Hdg_Selectedj v -i 46 

:= Selected if Offside_Hdg_Selectedj v _i46 

Purpose: This variable holds the most recent information on the base state of the 

lateral HDG mode of the offside FGS. 
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State Variable 


Offside_NAV 


Parent: Offside_Modes v -i35.0n 

Type: {Cleared, Selected} ty _23 

Initial Value: UNDEFINED 

Classified as: MONITORED 

:= Cleared if not Offside_Nav_Selectedj v _i4G 

:= Selected if Offside _Nav_Selectedi v _i46 


Purpose: This variable holds the most recent information on the base state of the 
lateral NAV mode of the offside FGS. 


State Variable 


Offside_NAV_Selected 


Parent: Offside_Modesy.135.On > Offside_N AV v . 137 . Selected 

Type: {Armed, Active} ty -23 
Initial Value: UNDEFINED 
Classified as: MONITORED 

: — Armed if not Offside_Nav_Activej v -i46 

:= Active if Offside_Nav_Activej v _i46 


Purpose: This variable holds the most recent information on the selected state of 

the lateral NAV mode of the offside FGS. 
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State Variable 


Offside_LAPPR 


Parent: 0ffside_Modes v _i35.0n 

Type: {Cleared, Selected } ty -23 

Initial Value: Undefined 

Classified as: MONITORED 

:= Cleared if not Offside_Lappr .Selected ; v - 147 

:= Selected if Offside .Lappr .Selected j v . 147 


Purpose: This variable holds the most recent information on the base state of the 

lateral APPR mode of the offside FGS. 


State Variable 


Offside_LAPPR_Selected 


Parent: Offside_Modes v -i 35 . 0 n > Offside_L APPR v -i3s- Selected 

Type: {Armed. Active}t y -23 

Initial Value: UNDEFINED 

Classified as: MONITORED 

:= Armed if not Off'side_Lappr_Activej v -i47 

:= Active if Offside_Lappr_Activej V .i47 


Purpose: This variable holds the most recent information on the selected state of 

the lateral APPR mode of the offside FGS. 





State Variable 


Offside_LGA 

Parent: Offside_Modes v _i 35 . 0 n 

Type: {Cleared, Selected }t y -23 

Initial Value: Undefined 

Classified as: MONITORED 

:= Cleared if not Offside_Lga_Selectedj v _i 47 

:= Selected if Offside_Lga_Selectedj v -i 47 

Purpose: This variable holds the most recent information on the base state of the 
lateral GA mode of the offside FGS. 


State Variable 


Offside.PITCH 


Parent : O ff’side.h Iodes v - 1 35 . On 

Type: {Cleared, Selected }ty-23 

Initial Value: Undefined 

Classified as: MONITORED 

:= Cleared if not Offside_Pitch_Selectedj v -i48 

: = Selected if Offside _Pitch_Selectedj v _ 14 s 


Purpose: This variable holds the most recent information on the base state of the 
vertical PITCH mode of the offside FGS. 
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State Variable 


Offside^ VS 


Parent: Offside JVlodeSv-135. On 

Type: {Cleared, Selected}t y -23 

Initial Value: UNDEFINED 

Classified as: MONITORED 

:= Cleared if not Offside_Vs_Selectedj v -i48 

: = Selected if Offside_Vs_Selected; v _i 48 


Purpose: This variable holds the most recent information 011 the base state of the 
vertical VS mode of the offside FGS. 


State Variable 


Offside_FLC 


Parent: Offside_Modes v .i35.0n 

Type: {Cleared, Selected } ty -23 

Initial Value: Undefined 

Classified as: MONITORED 

:= Cleared if not Offside_Flc_Selectedj V -i48 

:= Selected if Offside_Flc_Selectedj v _i 48 


Purpose: This variable holds the most recent information on the base state of the 

vertical FLC mode of the offside FGS. 
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State Variable 


Offside_ALT 


Parent: Offside_Modes v _i35.()n 

Type: {Cleared. Selected } t. v - 23 

Initial Value: Undefined 

Classified as: MONITORED 

:= Cleared if not Offside-Alt -Selected lv _ 149 

:= Selected if Offside_Alt_Selectedi v _i49 

Purpose: This variable holds the most recent information on the base state of the 

vertical ALT mode of the offside FGS. 


State Variable 


Offside-ALTSEL 


Parent: Offside_Modes v -i35-On 

Type: {Cleared. Selected}t y -23 

Initial Value: Undefined 
Classified as: MONITORED 

: — Cleared if not Offside-Altsel_Selectedj V _i4g 
:= Selected if Offside_AltseLSelectedi v _j49 

Purpose: This variable holds the most recent information on the base state of the 

vertical ALTSEL mode of the offside FGS. 
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State Variable 


Offside. ALTSEL -Selected 


Parent: Offside_Modes v -i35-Oii t> 0ffside_ALTSEL v _i4i. Selected 

Type: {Armed. Active} ty -23 

Initial Value: Undefined 

Classified as: MONITORED 

:= Armed if not Offside -Altsel.Activeiv.449 

:= Active if Offside_Altsel_Activei v -i49 


Purpose: This variable holds the most recent information on the selected state of 

the vertical ALTSEL mode of the offside FGS. 


State Variable 


Offside_ALTSEL.Active 


Parent: 

Offside.ModeSv_135.On o Offside. ALTSEL v .i4i .Selected t> Offside_ALTSEL_Selected v _i42. Active 

Type: {Capture, Track }t v _23 
Initial Value: UNDEFINED 
Classified as: MONITORED 

Capture if not Offside_Altsel_Trackj v _i 5 o 

:= Track if Offside _Altsel_Trackj v _ 150 


Purpose: This variable holds the most recent information on the active state of 
the vertical ALTSEL mode of the offside FGS. 
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State Variable 


Offside_V APPR 


Parent: Offside-Modes v .i35. On 

Type: {Cleared, Selected } ty -23 

Initial Value: Undefined 

Classified as: MONITORED 

:= Cleared if not Offside. Vappr_Selectedi v . 150 

:= Selected if Offside_Vappr_Selectedj v -i 50 

Purpose: This variable holds the most recent information on the base state of the 
vertical APPR mode of the offside FGS. 


State Variable 


Offside.VAPPR.Selected 


Parent: Offside.ModeSy.135.On t> Offside.VAPPRy.143. Selected 

Type: {Armed, Active} ty -23 

Initial Value: UNDEFINED 

Classified as: MONITORED 

:= Armed if not Offside.Vappr .Active^. 150 

:= Active if Offside_Vappr_Activej v _i5o 


Purpose: This variable holds the most recent information on the selected state of 
the vertical APPR mode of the offside FGS. 
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State Variable 


Offside.VGA 


Parent: Offside_Modes v -i 35 -On 

Type: {Cleared. Selected} ty -23 

Initial Value: UNDEFINED 

Classified as: MONITORED 

:= Cleared if not Offside_Vga_Selectedj v -i5l 

:= Selected if Offside_Vga_Selectedi v .i5i 

Purpose: This variable holds the most recent information on the base state of the 
vertical GA mode of the offside FGS. 


Definitions of Values to be Encapsulated 


Input Variable [ 


Offside_FGS_Active 


Type: Boolean 
Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside FGS 
believes it is active. 
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Input Variable 


Offside _FD_On 


Type: Boolean 
Initial Value: UNDEFINED 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside FD is 
turned on. 


Input Variable 


Offside_Modes_On 


Type: Boolean 
Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside modes 
are on. 


Input Variable 


Offside _Roll_Selected 


Type: Boolean 
Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside ROLL 
mode is selected. 
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Input Variable; 


OffsidehHdgJSelected 


Type: Boolean 
Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside 
Heading mode is selected. 


Input Variable [ 


Offside _Nav„Selected 


Type: Boolean 
Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside Nav 
mode is selected. 


Input Variable 


Offside_Nav_Active 


Type: Boolean 
Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside Nav 
mode is active. 


146 






Input Variable 


Offside _Lappr_Selected 


Type: Boolean 
Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside Lappr 
mode is selected. 


Input Variable 


Offside_Lappr_Active 


Type: Boolean 
Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside Lappr 
mode is active. 


Input Variable 


Offside_Lga_Selected 


Type: Boolean 
Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside Lga 
mode is selected. 
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Input Variable 


OffsideJPitch .Selected 


Type: Boolean 
Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside 
vertical Pitch mode is selected. 


Input Variable 


Offside_Vs ^Selected 


Type: Boolean 

Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside 
vertical Speed mode is selected. 


Input Variable 


Offside JFlc_Selected 


Type: Boolean 
Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside 
vertical Flight Level Change mode is selected. 
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Input Variable 


Offside_Alt_Selected 


Type: Boolean 
Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside 
vertical Altitude Hold mode is selected. 


Input Variable 


Offside _Altsel_Selected 


Type: Boolean 
Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside 

vertical Altitude Select mode is selected. 


Input Variable 


Offside_Altsel_Active 


Type: Boolean 
Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside 
vertical Altitude Select mode is active. 


149 






Input Variable 


Offside_Altsel_Track 


Type: Boolean 
Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside 
vertical Altitude Select mode is tracking. 


Input Variable 


Offside_Vappr_Selected 


Type: Boolean 
Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside Vappr 

mode is selected. 


Input Variable 


Offside_Vappr .Active 


Type: Boolean 
Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside Vappr 
mode is active. 
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Input Variable 


OfFside_Vga_Selected 


Type: Boolean 
Initial Value: Undefined 
Classified as: Input 

Purpose: This input variable holds the most recent information on whether the offside Vga 
mode is selected. 
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2.15 FGS Inputs 

This section defines the physical interface for all inputs to the FGS. The input variables 
associated with these fields are defined in the part of the specification to which they are 
logically related. 


Message 


Other Jnput JMsg 


Fields: AltSel 

is 

Boolean 

. AltselAet 

is 

Boolean 

, AltselSel 

is 

Boolean 

, AltselTrk 

is 

Boolean 

, FdOn 

is 

Boolean 

, FGSActive 

is 

Boolean 

, FlcSel 

is 

Boolean 

, HdgSel 

is 

Boolean 

, LapprAct 

is 

Boolean 

. LapprSel 

is 

Boolean 

. LgaSel 

is 

Boolean 

. ModesOn 

is 

Boolean 

, NavAct 

is 

Boolean 

. NavSel 

is 

Boolean 

, PthSel 

is 

Boolean 

. RollSel 

is 

Boolean 

, VapprAct 

is 

Boolean 

, VapprSel 

is 

Boolean 

, VgaSel 

is 

Boolean 

. VsSel 

is 

Boolean 


Message 


This .Input _Msg 
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Fields: AltPreRefChanged 

is 

Boolean 

, AltselCaptureCondMet 

is 

Boolean 

, Altsel Target Alt Changed 

is 

Boolean 

, AltselTrackCondMet 

is 

Boolean 

, AltSwi 

is 

{OFF. 0N} ty . m 

, ApDiscSwi 

is 

{OFF. 0N} ty . 117 

, ApEngSwi 

is 

{OFF, 0N} ty _ii7 

, ApprSwi 

is 

{OFF, ON} ty . 117 

, FdSwi 

is 

{OFF, 0N} ty . 117 

, FlcSwi 

is 

{OFF. ON} tv _ 117 

, GaSwi 

is 

{OFF. 0N} ty . n7 

, HdgSwi 

is 

{OFF. ON} ty .n7 

. LapprTrackCondMet 

is 

Boolean 

, NavSwi 

is 

{OFF. ON} ty _i 17 

, NavTrackCondMet 

is 

Boolean 

, Overspeed 

is 

Boolean 

, SyncSwi 

is 

{OFF, ON} ty _ m 

, TransSwi 

is 

{OFF, ON} ty - 117 

, VapprTrackCondMet 

is 

Boolean 

, VsPthWhlMot 

is 

Boolean 

, VsSwi 

is 

{OFF. ONjty.m 


Input Interface 


Other_Input 


Min. Separation: Undefined 

Max. Separation: UNDEFINED 

Input Action: R E A D ( O t her _In p u t _Msg„,_ i 52 ) 

Handler 

Guard Condition: True 


153 



Assignment (s) Offside_Alt_Selectedj v -i49 
Offside_Altsel_A.ctiveiv- 149 
Offside_AltseLSelectediv-i49 
OfFside_AltseLTracki v _i5o 
Offside_FD_On iv .i45 
0 ffside_FG S _ Act i vejv- 1 44 
Offside.Flc_Selectedjv.i 48 
Offside _Hdg_Selectedj v _i 46 
Offside_Lappr_Selectedj v .i47 
Offside _Lappr_Activej v _i47 
Offside_Lga_Selectedj v .i47 
Offside_Modes_Onj v -i45 
Offside _Nav _Activej v _ 146 
Offside_Nav_Selectedj v _i 46 
Offside.Pitch-Selectedjv -148 

Offside_RolLSelectedj V .i45 
Offside_Vappr_Selectedj v .i5o 
Offside_Vappr_Activej Y -i5o 
Offside_Vga_Selectedj v -i5i 
Offside _Vs_Selectedj v . 148 


is assigned 
is assigned 
is assigned 
is assigned 
is assigned 
is assigned 
is assigned 
is assigned 
is assigned 
is assigned 
is assigned 
is assigned 
is assigned 
is assigned 
is assigned 
is assigned 
is assigned 
is assigned 
is assigned 
is assigned 


AltSel 

AltselAct 

AltselSel 

AltselTrk 

FdOn 

FGSActive 

FlcSel 

HdgSel 

LapprSel 

LapprAct 

LgaSel 

ModesOn 

NavAct 

NavSel 

PthSel 

RollSel 

VapprSel 

VapprAct 

VgaSel 

VsSel 
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Input Interface 


This_Input 


Min. Separation: Undefined 
Max. Separation: UNDEFINED 
Input Action: READ(ThisJnput_Msg m -i 52 ) 


Handler 

Guard Condition: True 
Assignment (s) 

Is_ALTSEL_Capture_Cond_Meti V -ioi 

ALTSEL_Target_Altitude_Changedi v .i 29 

Is_ALTSEL_Track_Cond_Metj v _ioi 

ALT_Switchiv-i2i 

AP_Disconnect_Switchi V .i26 

AP .Engage .Switchiv- 1 26 

APPR_Switchi V . 1 23 

FD_Switchiv-ii 8 

FLC_Switchiv-i22 

GA-Switchiv-124 

HDG-Switchjv.ns 

Is-LAPPR_Track_Cond_Metiv-ioi 

NAV_Switchiv-ii 9 

Is_N AV_Tr ack_Cond_Met iv - i oo 

Overspeedjv-128 

SYNC_Switchi v .i 25 

Transfer _S witch j v _ 1 25 

Is-VAPPR.Track_Cond_Metiv.io2 

VS-Pitch_WheelJn_Motioniv-i 25 

VS-Switchi V -i2o 


is assigned 

AltselCapt ureCondMet 

is assigned 

AltselTargetAltChanged 

is assigned 

AltselTrackCondMet 

is assigned 

AltSwi 

is assigned 

ApDiscSwi 

is assigned 

ApEngSwi 

is assigned 

ApprSwi 

is assigned 

FdSwi 

is assigned 

FlcSwi 

is assigned 

GaSwi 

is assigned 

HdgSwi 

is assigned 

LapprTrackCondMet 

is assigned 

NavSwi 

is assigned 

NavTrackCondMet 

is assigned 

Overspeed iv .i28 

is assigned 

SyncSwi 

is assigned 

TransSwi 

is assigned 

VapprTrackCondMet 

is assigned 

VsPthWhlMot 

is assigned 

VsSwi 
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2.16 FGS Outputs 

This section defines the physical interface for all outputs from the FGS. The output variables 
associated with these fields are defined in the part of the specification to which they are 
logically related. 


Message 


This_Output_Msg 


Fields: AltLanrp 

is 

{OFF, ON} ty . 118 

. AltSel 

is 

Boolean 

, AltselAct 

is 

Boolean 

. AltselSel 

is 

Boolean 

. AltselTrk 

is 

Boolean 

. ApEng 

is 

Boolean 

. ApLamp 

is 

{OFF. ON} ty . n8 

. ApprLamp 

is 

{OFF. ONJty-ns 

, FdOn 

is 

Boolean 

, FGSActive 

is 

Boolean 

, FlcLamp 

is 

{OFF. ON} ty . 118 

, FlcSel 

is 

Boolean 

, HdgLamp 

is 

{OFF. ON}t y .n 8 

, HdgSel 

is 

Boolean 

, LapprAct 

is 

Boolean 

, LapprSel 

is 

Boolean 

, LgaSel 

is 

Boolean 

, ModesOn 

is 

Boolean 

. NavAct 

is 

Boolean 

, NavLamp 

is 

{OFF. ON} ty .ii8 

, NavSel 

is 

Boolean 

, PilotFlying 

is 

{LEFT. RIGHT}, v _ 2 :s 

. PthSel 

is 

Boolean 

, RollSel 

is 

Boolean 

. VapprAct 

is 

Boolean 

. VapprSel 

is 

Boolean 

, VgaSel 

is 

Boolean 

. VsLanrp 

is 

{OFF. ON},y.„8 

. VsSel 

is 

Boolean 
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Macro 


When_Lateral_Mode_Changed 


Condition: 


OR 


Changed (Is_R OLL -Selected v _38 ) 


T 







Changed ( Is_HDG -Selected v _4 1 ) 



T 






Changed (Is_N AV_Select ed v _46 ) 




T 





Changed (Is _N AV-Act ive v _46 ) 





T 




Changed (Is_L APPR_Selected v- 52 ) 






T 



Changed(Is_LAPPR_Active v _52) 







T 


Changed(Is_LGA_Selected v -57) 








T 


Macro 


WhenJVertical_Mode_Changed 


Condition: 


OR 


Changed (Is_PITCH_Selected v . 63 ) 


T 










Changed ( Is_VS_Selected v -66 ) 



T 









Changed(Is_ALT_Selected v _74) 




T 








Changed ( Is_ALTSEL_Selected v . 79 ) 





T 







Changed(Is_ALTSEL_Active v -8o) 






T 






Changed ( Is_ ALTS EL -Track v -80 ) 







T 





Changed ( Is_FLC_Selected v -7o ) 








T 




Changed(Is_VAPPR_Selected v _ 87 ) 









T 



Changed(Is_VAPPR_Active v - 87 ) 










T 


Changed(Is_VGA_Selected v _ 92 ) 











T 
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Macro 


When.Lamp ^Changed 


Condition: 


Changed ( AP_Lamp v . 1 20 ) 
Changed(APPR.Lamp v _i 24 ) 
Changed(HDG_Lamp v _] 19) 
Changed ( N AV_Lamp v _i2o ) 
Changed( VS_Lamp v .i2i) 
Changed (ALT_Lamp v _ 122) 

C 1 1 anged ( F L C _L am p v _ 123) 
Changed(APPR_Lamp v _i 24 ) 


OR 


T 









T 









T 






— 

— 

— 

T 

T 


— 

— 


— 


— 

— 

T 

T 









T 
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Output Interface 


This.Output 


Min. Separation: UNDEFINED 
Max. Separation: Undefined 
Output Action: PUBLISH (This_Output_Msg ni . 150 ) 


Handler 

Guard Condition: 


OR 


Changed (Mode_Annunciations_Oiiv-33) 


T 








Changed ( Pi lot _F ly ing v _29 ) 



T 







Changed ( Onside-FD _ 0 n v - 28 ) 




T 






Changed(Is_Tlhs_Side_Active v -3o) 





T 





Changed ( Is _AP .Engaged v - 131) 






T 




When_Lateral_Mode_Changed m . 1 57 ( ) 







T 



WhenJVerticaLMode_Changed m _i57() 








T 


When_Lamp.Changed m .i58() 









T 
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Assignment (s) 


Action: Send 


AltLamp 

is assigned 

AltSel 

is assigned 

AltselAct 

is assigned 

AltselSel 

is assigned 

AltselTrk 

is assigned 

ApEng 

is assigned 

ApLamp 

is assigned 

ApprLamp 

is assigned 

FdOn 

is assigned 

FGSActive 

is assigned 

FlcLamp 

is assigned 

FlcSel 

is assigned 

HdgLamp 

is assigned 

HdgSel 

is assigned 

LapprSel 

is assigned 

LapprAct 

is assigned 

LgaSel 

is assigned 

ModesOn 

is assigned 

NavAct 

is assigned 

NavLamp 

is assigned 

NavSel 

is assigned 

PilotFlying 

is assigned 

PthSel 

is assigned 

RollSel 

is assigned 

VapprSel 

is assigned 

VapprAct 

is assigned 

VgaSel 

is assigned 

VsLamp 

is assigned 

VsSel 

is assigned 


ALT_Lamp v -i22 

Is_ALTJSelected v -74 

Is_ALTSEL_Active v _8o 

Is_ALTSEL_Selected v -79 

Is_ALTSEL_Track v -80 

Is_AP-Engaged v -i3i 

AP_Lamp v -i26 

APPR _Lamp v _i24 

Onside_FD.On v -28 

Is_This_Side_Active v _3o 

FLC_Lampv-i 23 

Is_FLC_Selected v _7o 

HDG-Lampv-119 

Is_HDG_Selected v _4i 

Is_L APPR _Selected v _52 

Is_L APPR _Act ive v _52 

Is_LGA_Selected v .57 

Mode_Aiinuiiciations-On v .33 

Is_NAV_Active v _46 

NAV_Lamp v _i2o 

Is_NAV_Selectedv -46 

Pilot_Flyingv -29 

Is-PITCH-Selected v .63 

Is_R OLL -Selectedy -38 

Is-VAPPR_Selectedv -87 

Is-VAPPR _Active v -87 

Is_VGA_Selected v _92 

VS-Lampv-121 

Is_VS-Selectedv-66 
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Definition, 124 
Reference(s). 115, 155 

HDG (State Variable) 

Definition, 43 
Reference(s), 41, 42 
HDG-Lainp (State Variable) 

Definition. 119 
Reference(s), 158, 160 
HDG_Switch (Input Variable) 

Definition, 118 
Reference(s), 108, 155 

Independent-Mode (State Variable) 

Definition, 31 
Reference(s). 30 

Independent-Mode-Condition (Macro) 
Definition. 31 
Reference(s). 31 
Is_ALT_Active (State Variable) 

Definition, 74 

Reference(s), 61, 69, 77, 78 
Is _ALT -Selected (State Variable) 

Definition. 74 
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Is_ALTSEL_Active (State Variable) 
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Is_ALTSEL_Traek_ConcLMet (Input Variable) 
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Is_AP_Engaged (State Variable) 

Definition, 131 

Reference (s). 32. 126. 159, 160 
Is-FLC_Active (State Variable) 

Definition, 71 
Reference(s), 61 

Is_FLC_Selected (State Variable) 

Definition, 70 

Reference(s). 123, 157, 160 
Is_HDG_Active (State Variable) 

Definition, 41 
Reference(s), 36 

Is _HDG -Selected (State Variable) 

Definition, 41 

Reference(s), 119, 157, 160 
Is_LAPPR_Active (State Variable) 

Definition, 52 

Reference (s), 31, 36, 85, 157, 160 
Is_LAPPR_Selected (State Variable) 
Definition, 52 

Reference(s). 86, 124. 157, 160 
Is_LAPPR_Track-Cond-Met (Input Variable) 
Definition, 101 
Reference(s), 98. 155 
Is_LGA_Active (State Variable) 

Definition, 57 
Reference(s), 36 

Is_LGA_Selected (State Variable) 

Definition. 57 
Reference(s), 157. ICO 
IsJMAV-Active (State Variable) 

Definition, 46 
Reference(s), 36. 157, 160 
Is_NAV_Selected (State Variable) 

Definition, 46 

Reference(s), 120. 157, 160 
Is_NAV_Track_Cond_Met (Input Variable) 
Definition, 100 
Reference(s). 95, 155 

Is-No_Nonbasic_Lateral_Mode_Active (Macro) 
Definition, 36 
Reference(s), 37 

Is_\o_Nonbasic_VerticaLMode_ Active (Macro) 
Definition, 61 
Reference(s), 62 


Is_Offside_LAPPR_Active (State Variable) 
Definition, 134 
Reference(s), 31 

Is-Offside_VAPPR_Active (State Variable) 
Definition, 134 
Reference(s), 31 

Is_Offside_VGA_Active (State Variable) 
Definition, 135 
Reference(s). 31 

Is_PITCH .Active (State Variable) 

Definition. 63 

IsJPITCH-Selected (State Variable) 

Definition, 63 
Reference(s). 157. 160 
Is_ROLL_Active (State Variable) 

Definition, 38 

Is_ROLL-Selected (State Variable) 

Definition. 38 
Reference(s), 157, 160 
Is_This-Side_Active (State Variable) 

Definition. 30 

Reference(s), 26, 27, 34. 39. 42. 43. 47-49, 
53-55, 58, 59. 64, 67. 68. 71. 72. 75, 76. 
81-84. 88-90, 93. 94. 159. 160 
Is.VAPPR-Active (State Variable) 

Definition, 87 

Reference(s), 27, 31. 61. 65, 69, 73, 77, 78, 
157, 160 

Is_VAPPR_Selected (State Variable) 

Definition. 87 
Reference(s), 124. 157. 160 
Is_VAPPR_Track_Cond_Met (Input Variable) 
Definition, 102 
Reference(s), 99. 155 
Is_VGA_Active (State Variable) 

Definition, 92 

Reference(s), 31, 61, 77, 78 
Is_VGA_Selected (State Variable) 

Definition, 92 
Reference (s), 157, 160 
Is_VS_Active (State Variable) 

Definition, 66 
Reference(s), 27, 61 
Is_VS -Selected (State Variable) 

Definition, 66 
Reference(s), 121. 157, 160 

LAPPR (State Variable) 
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Definition, 54 
Reference(s), 52, 53, 55 
LAPPR -Selected (State Variable) 

Definition. 55 
Reference(s), 52-54 
LGA (State Variable) 

Definition, 59 
Reference(s), 57, 58 
Lamp (Type) 

Definition, 118 

Reference(s). 119-124. 12G. 156 

Mode_Annunciations-On (State Variable) 
Definition, 33 

Reference(s), 25-27, 159, 160 
Modes (State Variable) 

Definition, 34 

Reference(s), 33, 37, 39. 40, 43, 45, 48, 49. 
51. 54-56, 59, 62, 64, 65, 68, 70. 72, 73. 
76 - 78 , 82 - 84 , 86 , 89 - 91 , 94 

NAV (State Variable) 

Definition, 48 
Reference(s), 46, 47, 49 
NAV -Lamp (State Variable) 

Definition, 120 
Reference(s), 158, 160 
NAV -Selected (State Variable) 

Definition, 49 
Reference(s), 46-48 
NAV -Switch (Input Variable) 

Definition, 119 
Reference(s), 107. 155 

No-HigherJ^ vent -Than .ALT -Switch -Pressed 
(Macro) 

Definition, 113 
Reference(s), 112. 113 
No_HigherJEvent_Than_ALTSEL_Capture_- 
ConcLMet 
(Macro) 

Definition. 98 
Reference(s), 97 

No_Higher_Event_Than_ALTSEL_Target_- 

Altitude.Changed 

(Macro) 

Definition, 114 
Reference(s), 113, 114 


No-Higher_Event_Than-ALTSEL_Track_Cond-- 

Met 

(Macro) 

Definition, 97 
Reference(s), 96 

No_Higher_Event_Than-AP_Disconnect_Switch_ 

Pressed 

(Macro) 

Definition, 107 
Reference(s), 106, 107 

No_Higher-Event-Than-AP_Engage-Switch_- 

Pressed 

(Macro) 

Definition, 106 
Reference(s), 105, 106 

No_HigherJEvent_Than-APPR -Switch-Pressed 
(Macro) 

Definition, 115 
Reference(s), 109. 114. 115 

No_Higher_Event_Than_FD_Switch -Pressed 
(Macro) 

Definition. 104 
Reference(s), 96-100, 103 

No-Higher-Event-Thaii-FLC-Switch-Pressed 

(Macro) 

Definition, 112 
Reference(s), 111, 112 

No-Higher _Event_Than_GA-Switch_Pressed 
(Macro) 

Definition, 116 
Reference(s), 115, 116 

No-Higher_Event-Than_HDG -Switch-Pressed 
(Macro) 

Definition, 109 
Reference(s), 108, 109 

No.Higher -Event _Than_L APP R . Track-Gond -- 
Met 

(Macro) 

Definition. 99 
Reference(s). 98 

No_Higlier_Event_Than_NAV -Switch-Pressed 
(Macro) 

Definition, 108 
Reference(s), 105, 108 

No-Higher _Event_Than_NAV_Track-Cond_Met 
(Macro) 

Definition. 96 
Reference(s), 95 
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No_Higher-Event-Than_SYNC_Switch_Pressed 

(Macro) 

Definition, 117 
Reference(s). 116. 117 

No_Higher_Event_Tlian_Transfer -Switch-Pressed 
(Macro) 

Definition, 105 
Reference(s), 104 

No-Highei-Event-Than-VAPPR_Track-Cond-- 

Met 
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